CVE-2026-109795 is a critical (CVSS 9.9) code injection vulnerability. SAP NetWeaver skips authorization checks and does not validate input properly, so an attacker with low privileges can run arbitrary code through a remote interface.
What Is It
SAP, acting as the CNA, says SAP NetWeaver "does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality." An authenticated attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code on the affected system.
The flaw is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The NVD record has status "Received," so NVD has not completed its own analysis yet.
Why It Matters
SAP's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base score 9.9 (CRITICAL):
- Network-reachable with low attack complexity
- Requires only low privileges and no user interaction
- Scope changed: SAP says successful exploitation "could extend the attacker's reach beyond the vulnerable component"
- High impact on confidentiality, integrity and availability
Any low-privileged account that can reach the remote-enabled functionality could lead to full system compromise.
The supplied CISA KEV data has no entry for this CVE. CISA KEV does not confirm active exploitation right now, and no CISA-required action or due date applies. Watch for this to change, since KEV status is often updated after disclosure.
What's Vulnerable
The record's description names SAP NetWeaver, but its affected data lists the vendor as SAP_SE and the product as S4CRM. The following versions are marked affected:
- S4CRM: 204, 205, 206
- S4CEXT: 107, 108, 109
- BBPCRM: 713, 714
All other versions are listed as unaffected by default. The NVD record has no CPE entries yet.
Patch Status
The record points to SAP Note 3834842 and SAP's Security Patch Day page. The supplied data does not describe the fix itself or any workaround. SAP customers should:
- Review SAP Note 3834842 (an SAP support login is required)
- Apply the remediation it describes to affected S4CRM, S4CEXT and BBPCRM releases
- Until patched, limit which low-privileged accounts can reach remote-enabled interfaces
Sources
- NVD: CVE-2026-109795
- SAP Note 3834842
- SAP Security Patch Day
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)