CVE-2026-109803
Received Received - Intake

SAP NetWeaver Knowledge Management XSLT Arbitrary Code Execution

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-109803
EUVD
EUVD-2026-120686

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver_knowledge_management *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP NetWeaver Knowledge Management (XML Forms) has a flaw where it does not properly restrict XSL transformations. An authenticated user with access to this feature could trigger an unauthorized XSL transformation, potentially leading to arbitrary code execution within the application. This could compromise the application's confidentiality, integrity, and availability.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized XSL transformations in SAP NetWeaver Knowledge Management. Review system logs for unexpected XML processing requests or transformations. Use SAP transaction codes like ST01 for trace analysis or SM19/SM20 for security audit logs. Inspect network traffic for unusual XML/XSLT exchanges.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code in the application context. This may result in unauthorized access to sensitive data, modification or deletion of data, disruption of services, or complete system compromise, depending on the attacker's goals and permissions.

Compliance Impact

This vulnerability could lead to breaches of confidentiality and integrity, which are key concerns for GDPR and HIPAA. Unauthorized code execution may result in data leaks, unauthorized access, or data tampering, potentially violating compliance requirements for data protection and security.

Mitigation Strategies

Apply the official SAP security note 3809153 to patch the affected SAP NetWeaver Knowledge Management component. Restrict user access to the vulnerable functionality until the patch is applied. Monitor for unusual XSL transformation requests or unauthorized code execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...