Input Validation Flaw in SAP NetWeaver's Internet Graphics Service
CVE-2026-109807

7.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver (internet Graphics Service)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109807?

SAP NetWeaver's Internet Graphics Service is susceptible to insufficient input validation, allowing unauthenticated users to craft malicious requests. This can lead to the affected worker process reading beyond its designated values, which may cause repeated failures and significantly affect system availability.

Affected Version(s)

SAP NetWeaver (Internet Graphics Service) BC-FES-IGS 7.20EXT

SAP NetWeaver (Internet Graphics Service) 7.20_EXT2

SAP NetWeaver (Internet Graphics Service) 7.53

References

https://me.sap.com/notes/3809934
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.