SAP NETWEAVER APPLICATION SERVER ABAP · CVE-2026-109793 · Vendor
NO FIX YET
SAP NetWeaver ABAP (ICM) and SAP Web Dispatcher do not sufficiently validate certain header values in inbound requests. An unauthenticated attacker can send a crafted request that makes the process unavailable (CVSS 7.5, availability only). Fix per SAP Note 3808627; patched versions not confirmed from a primary source.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-run SAP NetWeaver Application Server ABAP systems and SAP Web Dispatcher that handle inbound HTTP(S) requests through the Internet Communication Manager. An unauthenticated attacker who can reach the HTTP port can send a crafted request that makes the process unavailable (no confidentiality or integrity impact). Systems whose ICM/Web Dispatcher is not reachable by untrusted clients are at lower risk.
Who cares abap, dos, icm, netweaver, sap, unauthenticated, web-dispatcher
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.