An authenticated user with low privileges can, under certain conditions, make SAP NetWeaver Knowledge Management (XML Forms) process an unauthorized XSL transformation, which could lead to arbitrary code execution (CVSS 9.9, Critical).
What Is It
CVE-2026-109803 is a code injection vulnerability (CWE-94) in SAP NetWeaver Knowledge Management (XML Forms). According to SAP's description, the affected functionality does not sufficiently restrict which XSL transformations it processes. Under certain conditions, an authenticated user with access to that functionality can cause an unauthorized XSL transformation to run. That can lead to arbitrary code execution in the application context.
SAP, acting as the CNA, published the record. NVD lists its status as "Received," which means NVD has not yet done its own analysis.
Why It Matters
SAP rates this flaw 9.9 out of 10 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable: an attacker can exploit it remotely, with low attack complexity.
- Low privileges needed: the attacker needs an authenticated account with access to the affected functionality, not an admin account.
- No user interaction: no victim has to take any action.
- Scope changed: the impact can reach beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
SAP NetWeaver often holds sensitive enterprise content. Code execution that a low-privileged authenticated user with access to the affected functionality can reach, under certain conditions, is a serious risk in multi-user deployments.
Exploitation status: As of this writing, the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation in the wild is not confirmed.
What's Vulnerable
| Vendor | Product | Affected Version |
|---|---|---|
| SAP SE | SAP NetWeaver Knowledge Management (XML Forms) | KMC-CM 7.50 |
The CNA record sets the default status to "unaffected," so only the version listed above is identified as vulnerable. The NVD record does not list any CPE entries yet.
Patch Status
SAP points to SAP Note 3809153 and its Security Patch Day page. Organizations running KMC-CM 7.50 should review that note and apply the remediation SAP provides. SAP Notes usually require an SAP support login.
Because the CVE is not currently listed in the CISA KEV catalog, no KEV-mandated federal required action or due date applies at this time. Given the critical score and the low bar for exploitation, treat this as a high-priority patch anyway.