Authorization Check Flaw in SAP NetWeaver Application Server Java by SAP
CVE-2026-109809

6.5MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Java (nwdi Cockpit)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109809?

The SAP NetWeaver Application Server Java (NWDI Cockpit) has a vulnerability where insufficient authorization checks permit low-privileged attackers to make unauthorized modifications. This flaw primarily impacts the integrity of the application, allowing unapproved changes without affecting the confidentiality or availability of the system. Organizations using this product should take immediate action to review their security measures and apply the relevant updates as indicated in SAP's security patch notes.

Affected Version(s)

SAP NetWeaver Application Server Java (NWDI Cockpit) DI_NTY 7..50

References

https://me.sap.com/notes/3839977
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.