CVE-2026-109796
Received Received - Intake

Memory Disclosure in SAP NetWeaver ABAP Platform

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109796
EUVD
EUVD-2026-120681

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver_application_server_abap *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP NetWeaver Application Server ABAP and ABAP Platform improperly initializes memory in certain internal components. This allows an attacker with low privileges to disclose uninitialized memory contents under specific conditions, leading to low confidentiality impact.

Detection Guidance

This vulnerability involves uninitialized memory disclosure in SAP NetWeaver Application Server ABAP. Detection requires applying SAP Security Notes and monitoring for unusual memory access patterns. Check SAP system logs for memory-related errors or unauthorized data exposure. Use SAP-provided tools like SAP Note 3769130 for patch verification and system scans.

Impact Analysis

An attacker could access sensitive data stored in uninitialized memory, such as credentials or configuration details, but only under specific conditions and with low privileges. Integrity and availability of the system are not affected.

Compliance Impact

This vulnerability may lead to unauthorized disclosure of personal or sensitive data, which could violate GDPR or HIPAA requirements for data protection and confidentiality. Organizations should apply patches to mitigate risks.

Mitigation Strategies

Apply the latest SAP Security Notes from SAP Security Patch Day to address the memory initialization issue in SAP NetWeaver Application Server ABAP and ABAP Platform.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109796. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...