Resource Consumption Vulnerability in SAP NetWeaver Application Server and SAP Web Dispatcher
CVE-2026-109794

7.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Abap, Abap Platform And SAP Web Dispatcher
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109794?

SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher are susceptible to a resource consumption issue when handling specific types of requests. An unauthenticated threat actor can exploit this vulnerability by sending tailored requests, leading to substantial resource usage that may cause service disruptions. Although this issue does not affect data confidentiality or integrity, its impact on service availability can be significant, disrupting business operations and affecting user access.

Affected Version(s)

SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher WEBDISP 7.77

SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher 7.93

SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher 9.16

References

https://me.sap.com/notes/3805681
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.