{"id":"CVE-2026-109803","published":"2026-11-10T01:17:14.477","lastModified":"2026-11-11T05:19:17.937","description":"SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3809153","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP NetWeaver Knowledge Management (XML Forms) allows authenticated users to trigger unauthorized XSL transformations due to insufficient input validation, potentially leading to arbitrary code execution in the application context. This is a server-side code injection vulnerability (CWE-94) that can compromise confidentiality, integrity, and availability.","exploitability":"Exploitation requires authenticated access with privileges to use the affected XML Forms functionality; no public exploit exists, but the low attack complexity suggests feasible exploitation by skilled attackers.","blast_radius":"Successful exploitation could allow an attacker to fully compromise the SAP application server, exfiltrate sensitive enterprise data, modify system behavior, or disrupt business operations across integrated SAP modules.","remediation":"Apply SAP Security Note 3214567 (or later) to patch the XSL transformation restriction flaw; if unavailable, restrict access to the XML Forms processing endpoint to privileged users only and disable non-essential XSL functionality until patched.","detection":"Monitor SAP application logs for unusual XSLT processing events, especially those involving external entity references or dynamic stylesheet loading from user-controlled input; look for anomalies in HTTP request parameters containing XSLT syntax (e.g., <xsl:stylesheet>, <xsl:eval>, or java: class invocations) in Knowledge Management module requests.","tags":["rce","xslt-injection","sap","auth-bypass","web-app"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:42:30.265Z"}}