SAP NetWeaver Authorization Flaws and Input Validation Issues
CVE-2026-109795

9.9CRITICAL

Key Information:

Vendor

SAP
Status
S4crm
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109795?

SAP NetWeaver has identified serious vulnerabilities due to inadequate authorization checks and insufficient input validation in remote-enabled functionalities. These flaws enable an attacker with minimal privileges to leverage specially crafted input through a remote interface. This can lead to the injection and execution of arbitrary code within the affected system. If successfully exploited, the attacker could potentially compromise broader system operations and data integrity, affecting confidentiality and availability across the network. It's crucial for users to apply the latest patches and security measures to mitigate these risks.

Affected Version(s)

S4CRM S4CRM 204

S4CRM 205

S4CRM 206

References

https://me.sap.com/notes/3834842
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.