CVE-2026-109795
CRITICAL
NVD
CVSS Score
9.9
Severity
CRITICAL
Published
Nov 10, 2026
Vendor
unknown
Description
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.