CVE-2026-109800
Received Received - Intake

Memory Corruption in SAP Web Dispatcher

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109800
EUVD
EUVD-2026-120683

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap web_dispatcher *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP Web Dispatcher has a flaw where it does not properly validate certain inputs. This can cause memory corruption. An attacker with non-admin access can exploit this by sending specially crafted input, leading the Web Dispatcher process to crash without any user interaction.

Detection Guidance

Detecting this vulnerability requires monitoring SAP Web Dispatcher logs for crashes or termination events. Check for unexpected process exits or memory corruption errors in logs. SAP provides tools like SAP Host Agent or SAP Solution Manager for monitoring. No specific commands are provided in the available resources.

Impact Analysis

This vulnerability can make SAP Web Dispatcher and all connected backend systems unavailable, causing a denial of service. It does not affect the confidentiality or integrity of data but severely disrupts system availability.

Compliance Impact

This vulnerability primarily impacts availability by causing the SAP Web Dispatcher to terminate, disrupting access to backend systems. GDPR and HIPAA focus on data confidentiality and integrity, which are not directly affected here. However, prolonged unavailability could impact compliance with availability requirements in these regulations.

Mitigation Strategies

Apply the latest security patches provided by SAP for Web Dispatcher as soon as possible. Monitor SAP notes for updates and restrict non-administrative user access to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109800. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...