CVE-2026-109801
Received Received - Intake

Authorization Bypass in SAP NetWeaver Application Server Java

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP NetWeaver Application Server Java (NWDI Cockpit)οΏ½ does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system users. Successful exploitation results in a high impact on confidentiality, with no impact on integrity or availability of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109801
EUVD
EUVD-2026-120684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver_application_server_java *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SAP NetWeaver Application Server Java (NWDI Cockpit) allows low-privileged attackers to send crafted requests and access sensitive information belonging to other users. The flaw stems from insufficient authorization checks for certain functions that retrieve data.

Detection Guidance

To detect this vulnerability, monitor SAP NetWeaver Application Server Java (NWDI Cockpit) for unauthorized access attempts to sensitive information. Check logs for unusual requests or data retrievals by low-privilege users. SAP provides tools like SAP Solution Manager or SAP Note 3839977 for detection.

Impact Analysis

An attacker could exploit this to steal confidential data from other users, leading to unauthorized access to sensitive information such as user credentials or personal details. This primarily affects confidentiality with no impact on system integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements for data protection such as GDPR and HIPAA. It risks non-compliance due to potential breaches of confidentiality and unauthorized access to personal or sensitive health information.

Mitigation Strategies

Apply the latest security patches from SAP as referenced in SAP Note 3839977 to address insufficient authorization checks in NWDI Cockpit.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...