Insufficient Authorization in SAP NetWeaver Application Server Java
CVE-2026-109801

6.5MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Java (nwdi Cockpit)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109801?

SAP NetWeaver Application Server Java (NWDI Cockpit) contains a vulnerability that fails to apply adequate authorization checks for certain functionalities that retrieve sensitive information. An attacker with minimal privileges can exploit this weakness by sending specially crafted requests, allowing them to access confidential data belonging to other users within the system. This poses a significant risk to user confidentiality, warranting immediate attention and remediation.

Affected Version(s)

SAP NetWeaver Application Server Java (NWDI Cockpit) DI_NTY 7.50

References

https://me.sap.com/notes/3839977
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.