Availability Issues in SAP NetWeaver Application Server ABAP and SAP Web Dispatcher
CVE-2026-109793

7.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Abap (internet Communication Manager) And SAP Web Dispatcher
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109793?

The SAP NetWeaver Application Server ABAP and SAP Web Dispatcher are susceptible to a vulnerability that arises from inadequate validation of certain header values during the processing of inbound requests. This flaw allows an unauthenticated attacker to craft specific requests that can disrupt the availability of these services, leading to potential downtime. While this vulnerability primarily affects service availability, it does not compromise the confidentiality or integrity of the data processed by the affected systems.

Affected Version(s)

SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher WEBDISP 9.16

SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher KERNEL 9.16

SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher 9.20

References

https://me.sap.com/notes/3808627
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.