# CVE-2026-120008

Unauthenticated request can crash SAP NetWeaver Internet Graphics Service (DoS).

- Page: https://www.vulneraibility.com/cve/CVE-2026-120008
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-787
- Published: 2026-11-10

## Affected versions

- SAP_SE SAP NetWeaver (Internet Graphics Service): affected BC-FES-IGS 7.20EXT; 7.20_EX2; 7.53; 7.54; 7.81; 9.16

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote specially-crafted request triggers out-of-bounds write, causing memory corruption or repeated process termination (DoS).

## Action

Immediate action required

## Recommendation

Restrict and monitor access to IGS endpoints; apply vendor updates as soon as released.

## References

- [other] https://me.sap.com/notes/3809953
- [other] https://url.sap/sapsecuritypatchday

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.