CVE-2026-109795
Received Received - Intake

Remote Code Execution in SAP NetWeaver

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109795
EUVD
EUVD-2026-120680

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP NetWeaver has a flaw where it does not properly check user permissions and fails to validate input correctly in certain remote functions. This allows attackers with low-level access to send specially crafted data through a remote interface, enabling them to inject and execute arbitrary code on the affected system. The impact is severe as it can lead to full system compromise.

Detection Guidance

Detecting this SAP NetWeaver vulnerability requires checking for unauthorized remote access attempts or unusual input patterns. Monitor logs for remote-enabled functionality abuse and inspect network traffic for crafted inputs. Use SAP tools like ST01 for trace analysis and SM19/SM20 for security audit logs. Check for unexpected system calls or code execution traces in affected components.

Impact Analysis

If exploited, this vulnerability could allow attackers to take control of your SAP NetWeaver system, leading to unauthorized access, data theft, system manipulation, or disruption of services. It could also enable attackers to move laterally within your network, affecting other connected systems.

Compliance Impact

This vulnerability could lead to breaches of GDPR by exposing personal data or HIPAA by compromising protected health information. Non-compliance risks include legal penalties, fines, and reputational damage due to unauthorized access or data leaks resulting from the flaw.

Mitigation Strategies

Apply SAP security notes and patches referenced in SAP Note 3834842. Restrict network access to SAP NetWeaver systems and disable unnecessary remote-enabled functionality. Monitor for unusual activity and review authorization settings to ensure least privilege.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...