SSRF Vulnerability in SAP NetWeaver and ABAP Platform

CVE-2026-109811

What is CVE-2026-109811?

The SAP NetWeaver and ABAP Platform contain a vulnerability in their internal ABAP HTTP component, stemming from insecure default configurations. This SSRF vulnerability could be exploited by authenticated users with low privileges, allowing them to induce victims into connecting to a malicious server. The attacker can gain access to sensitive information associated with the victim and may also modify limited non-sensitive data. Consequently, while the threat poses significant risks to confidentiality, it has minimal effects on data integrity and does not affect system availability.

References