CVE-2026-109795
CriticalCVSS 9.9Summary
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system.
Risk Assessment
Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability. This poses a serious risk to organizations running SAP NetWeaver.
Recommendation
Immediately apply the security updates provided by SAP and restrict access to remote interfaces to trusted networks and accounts.
Other vulnerabilities in SAP NetWeaver
See all- CVE-2026-109805Medium
SAP NetWeaver and ABAP Platform (Application Server ABAP) use a weak HMAC cryptography calculation when receiving an RFC callback. An authenticated attacker with high privileges and access to a network segment between application servers can intercept network communication and change the caller's identity, enabling unauthorized function calls with escalated privileges.
- CVE-2017-9845High
Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.
- CVE-2016-3635High
SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.
- CVE-2015-5067High
The Cross-System Tools and Data Transfer Workbench in SAP NetWeaver have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.
- CVE-2014-4003High
The System Landscape Directory (SLD) in SAP NetWeaver allows remote attackers to modify information via vectors related to adding a system.
- CVE-2015-7241Critical
The XXE vulnerability in SAP Netweaver before version 7.01 allows an attacker to exploit external XML entities to gain access to system data.
- CVE-2016-10311Critical
A stack-based buffer overflow in SAP NetWeaver versions 7.0 through 7.5 allows remote attackers to cause a denial of service by sending a crafted packet to the SAPSTARTSRV port.
- CVE-2026-58249High
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
- CVE-2026-76963Medium
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. This could expose security-relevant settings and internal system details, with low impact on confidentiality while integrity and availability remain unaffected.
- CVE-2026-58246Medium
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.
Original NVD description (English source)
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS