CVE-2026-76968: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere in SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server

This vulnerability (CVE-2026-76968) affects SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server. It allows an authenticated attacker with low privileges to access administrative functionality or interfaces, resulting in the exposure of sensitive system information. The disclosed information could potentially aid further attacks. The vulnerability impacts confidentiality only, with no effect on integrity or availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, and no user interaction.

The vulnerability leads to unauthorized disclosure of sensitive system information, which compromises the confidentiality of the affected SAP components. There is no impact on system integrity or availability. The exposed information could be leveraged to facilitate additional attacks, increasing the risk to the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor SAP's official security advisories for updates. In the meantime, restrict access to administrative interfaces to trusted users only and enforce strong authentication controls to limit exposure.