CVE-2026-109811
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.