Improper Restriction in SAP NetWeaver Knowledge Management by SAP
CVE-2026-109803

9.9CRITICAL

Key Information:

Vendor

SAP
Status
SAP Netweaver Knowledge Management (xml Forms)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109803?

The SAP NetWeaver Knowledge Management component has a security flaw that fails to adequately restrict XSL transformations. This vulnerability can be exploited by authenticated users who have access to specific features of the application. By manipulating the XSL transformation process, an attacker could initiate unauthorized transformations, which may lead to the execution of arbitrary code within the application context. Such an occurrence poses significant risks to the confidentiality, integrity, and availability of the system. It is crucial for users to apply the recommended security patches and updates to mitigate potential risks associated with this vulnerability.

Affected Version(s)

SAP NetWeaver Knowledge Management (XML Forms) KMC-CM 7.50

References

https://me.sap.com/notes/3809153
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.