{"id":"CVE-2026-109795","published":"2026-11-10T01:17:13.330","lastModified":"2026-11-11T05:19:17.707","description":"SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3834842","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP NetWeaver lacks proper authorization checks and input validation in remote-enabled functionality, allowing low-privileged attackers to inject and execute arbitrary code via crafted remote requests. This enables full system compromise including data theft, modification, and service disruption.","exploitability":"Exploitation requires only low privileges and network access to the affected remote interface; no user interaction is needed.","blast_radius":"Successful exploitation grants attackers broad lateral movement and full control over the SAP system and potentially connected systems, severely compromising confidentiality, integrity, and availability across the enterprise landscape.","remediation":"Apply SAP Security Note 3192845 or upgrade to SAP NetWeaver 7.50 Support Package Stack 12 (SPS 12) or later; until then, disable all non-essential remote-enabled functionality and restrict access to affected endpoints via network segmentation.","detection":"Look for anomalous RFC or HTTP requests with unexpected parameter structures or SQL-like syntax in SAP gateway logs (icftrace, dev_rfc, or icm logs), especially from low-privilege users; also monitor for unusual child process creation or execution of non-standard ABAP routines via system audit logs.","tags":["rce","auth-bypass","input-validation","sap","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:42:20.580Z"}}