Input Validation Flaw in SAP NetWeaver Application Server for ABAP
CVE-2026-109802

6.5MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server For Abap
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109802?

The SAP NetWeaver Application Server for ABAP has a flaw in input validation that allows authenticated users to send specially crafted requests. This can trigger an error within the server's internal processing, potentially causing a crash of the affected work process. Such a scenario can lead to system unavailability, significantly affecting operational efficiency without compromising data confidentiality or integrity. It is essential for users and administrators of affected systems to apply necessary patches and updates to mitigate this issue.

Affected Version(s)

SAP NetWeaver Application Server for ABAP KRNL64NUC 7.22

SAP NetWeaver Application Server for ABAP 7.22EXT

SAP NetWeaver Application Server for ABAP KRNL64UC 7.22

References

https://me.sap.com/notes/3793716
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.