Weak HMAC Cryptography Vulnerability in SAP NetWeaver and ABAP Platform
CVE-2026-109805

6.4MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver And Abap Platform (application Server Abap)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109805?

A weak HMAC cryptography calculation in SAP NetWeaver and ABAP Platform allows authenticated attackers with high privileges to intercept network communication between application servers. An attacker positioned within the same network segment can alter the identity of the caller, facilitating unauthorized function calls on the targeted server. This exploitation severely affects the confidentiality, integrity, and availability of the application, posing significant security risks.

Affected Version(s)

SAP NetWeaver and ABAP Platform (Application Server ABAP) KRNL64NUC 7.22

SAP NetWeaver and ABAP Platform (Application Server ABAP) 7.22EXT

SAP NetWeaver and ABAP Platform (Application Server ABAP) KRNL64UC 7.22

References

https://me.sap.com/notes/3786876
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.