medium · CVSS v3 6.5

CVE-2026-109802

SAP NetWeaver Application Server for ABAP contains an input validation flaw that allows authenticated users to send crafted requests, trigge

Overview

SAP NetWeaver Application Server for ABAP contains an input validation flaw that allows authenticated users to send crafted requests, triggering internal errors that crash work processes and cause a denial of service. The flaw does not affect confidentiality or integrity, but it can render the system unavailable. It is a medium‑severity vulnerability with a CVSS score of 6.5.

Description

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.

Impact

Availability is impacted: the server may crash, leading to a denial of service for users and applications dependent on the NetWeaver instance. Confidentiality and integrity remain unaffected. Defenders should consider the affected servers as high‑priority targets for patching and monitoring.

Remediation

Apply the SAP security patch that addresses CVE-2026-109802. If a patch is not yet available, restrict authenticated access to the vulnerable endpoints, isolate the affected server, or disable the specific feature that processes the problematic input. Continuously monitor system logs for error patterns and ensure that work processes are restarted automatically if a crash occurs.

Risk context

The vulnerability has a medium severity (CVSS 6.5) and no EPSS data is available. It poses a moderate risk of service disruption but does not expose data. Timely patching is recommended to mitigate potential downtime.

Affected products

  • SAP NetWeaver Application Server for ABAP

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
—

availability SAP NetWeaver denial-of-service authenticated input-validation patch

← All CVEs

Related CVEs

medium

CVE-2026-125375

MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.

View analysis

medium

CVE-2026-117477

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

View analysis

medium

CVE-2026-125077

A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

View analysis

medium

CVE-2026-125357

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../ to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.

View analysis