---
id: "CVE-2026-109793"
page: "https://infrastack.ai/live/CVE-2026-109793"
kind: "vulnerability"
aliases: ["CVE-2026-109793"]
title: "SAP NetWeaver ABAP and Web Dispatcher: crafted headers crash the process"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver Application Server ABAP", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "SAP Web Dispatcher", "fixed": [], "affected": "WEBDISP 9.16 (unconfirmed, from CVE-list mirror)", "ecosystem": "vendor"}, {"name": "SAP NetWeaver Application Server ABAP (kernel)", "fixed": [], "affected": "KERNEL 9.16, 9.20, 9.21 (unconfirmed, from CVE-list mirror)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["abap", "dos", "icm", "netweaver", "sap", "unauthenticated", "vendor", "web-dispatcher"]
not_affected_if: []
published_at: "2026-11-10T01:17:13+00:00"
first_seen_at: "2026-11-10T01:26:36+00:00"
updated_at: "2026-11-10T01:37:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109793", "first_seen_at": "2026-11-10T01:26:36+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap", "first_seen_at": "2026-11-10T01:37:15+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap", "https://nvd.nist.gov/vuln/detail/CVE-2026-109793"]}]
exploit_sources: []
---

# SAP NetWeaver ABAP and Web Dispatcher: crafted headers crash the process

Link for people: https://infrastack.ai/live/CVE-2026-109793 (this .md is for agents)

SAP NetWeaver ABAP (ICM) and SAP Web Dispatcher do not sufficiently validate certain header values in inbound requests. An unauthenticated attacker can send a crafted request that makes the process unavailable (CVSS 7.5, availability only). Fix per SAP Note 3808627; patched versions not confirmed from a primary source.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver Application Server ABAP affected range not listed fixed no fixed version listed
- vendor:SAP Web Dispatcher affected WEBDISP 9.16 (unconfirmed, from CVE-list mirror) fixed no fixed version listed
- vendor:SAP NetWeaver Application Server ABAP (kernel) affected KERNEL 9.16, 9.20, 9.21 (unconfirmed, from CVE-list mirror) fixed no fixed version listed

## How to check

Open SAP Note 3808627 in SAP for Me and compare your kernel (SM51 > Release Notes, or disp+work -V) and Web Dispatcher (sapwebdisp -v) versions with its list. Mirror lists WEBDISP 9.16 and KERNEL 9.16, 9.20, 9.21 (unconfirmed).

## Timeline

- 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109793
- 2026-11-10T01:37:15+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap — SAP note 3808627 (me.sap.com, login-gated) is the primary; not readable here and Nov 2026 patch day page not yet published in search. Affected list taken from CVE-list mirror (HOL), not verified: WEBDISP 9.16; KERNEL 9.16, 9.20, 9.21. Fix versions unknown. No exploitation reported. Nothing marked verified.

## Documents

- [describes] HOL Guard record CVE-2026-109793 (CVE list mirror) https://hol.org/guard/security/cves/CVE-2026-109793-denial-of-service-dos-vulnerability-in-sap
- [mentions] NVD CVE-2026-109793 https://nvd.nist.gov/vuln/detail/CVE-2026-109793

## From the sources

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable.This results in a high impact on availability. There is no impact on confidentiality and integrity.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_