{"id":"CVE-2026-109794","kind":"vulnerability","aliases":["CVE-2026-109794"],"related":[],"title":"SAP NetWeaver ABAP and Web Dispatcher: unauthenticated requests exhaust resources, crash service","description":"SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing excessive resource utilization and service disruption. This results in a high impact on availability. There is no impact on confidentiality and integrity.","summary":"SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher do not handle resource consumption properly for certain requests. An unauthenticated attacker can send crafted requests that drive up resource use and disrupt the service, with no confidentiality or integrity impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abap","dos","netweaver","sap","self-hosted","unauthenticated","vendor","web-dispatcher"],"not_affected_if":["unknown"],"how_to_check":"Unknown until SAP's note is read. Check the kernel release of each ABAP application server (SM51 or System > Status) and each SAP Web Dispatcher (sapwebdisp -v), then compare against the November 2026 SAP Security Note for CVE-2026-109794 in SAP for Me.","fix":null,"status":"open","published_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:38+00:00","updated_at":"2026-11-10T01:36:04+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:28:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP and Web Dispatcher: unauthenticated requests exhaust resources, crash service","impact":"medium","summary":"SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher do not handle resource consumption properly for certain requests. An unauthenticated attacker can send crafted requests that drive up resource use and disrupt the service, with no confidentiality or integrity impact.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap","web-dispatcher","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Service disruption from resource exhaustion; no data read or changed","analyst_note":"Find SAP's security note and the affected/fixed release list for CVE-2026-109794 at the vendor site, since NVD gives no versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running SAP NetWeaver Application Server ABAP, ABAP Platform or SAP Web Dispatcher that accept network requests from untrusted sources are exposed. The sources do not name the affected versions or the configurations that are vulnerable, so the exact scope is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4593,"output_tokens":539,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note and the affected/fixed release list for CVE-2026-109794 at the vendor site, since NVD gives no versions or fix.","search":"'-109794':15A,18A '-2026':14A,17A 'abap':3A,19B,35B,36B,77C,78C 'affect':104C 'applic':33B,75C 'attack':53B,96C 'avail':120C 'caus':106C 'certain':49B,92C 'compon':105C 'confidenti':69B,126C 'consumpt':46B,89C 'could':97C 'craft':56B,100C 'crash':11A 'cve':13A,16A 'dispatch':6A,30B,41B,83C 'disrupt':64B,112C 'dos':20B 'drive':59B 'excess':107C 'exhaust':9A 'handl':44B,87C 'high':117C 'host':25B 'impact':72B,118C,124C 'integr':71B,128C 'netweav':2A,21B,32B,74C 'platform':37B,79C 'process':91C 'proper':47B 'request':8A,50B,57B,93C,101C 'resourc':10A,45B,61B,88C,108C 'result':114C 'sap':1A,22B,31B,39B,73C,81C 'self':24B 'self-host':23B 'send':55B,98C 'server':34B,76C 'servic':12A,66B,111C 'special':99C 'suffici':86C 'unauthent':7A,26B,52B,95C 'use':62B 'util':109C 'vendor':27B 'web':5A,29B,40B,82C 'web-dispatch':28B","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver Application Server ABAP, ABAP Platform or SAP Web Dispatcher that accept network requests from untrusted sources are exposed. The sources do not name the affected versions or the configurations that are vulnerable, so the exact scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abap","dos","high","netweaver","sap","selfhosted","unauthenticated","vendor","webdispatcher"],"campaign_type":null,"search_a":"'-109794':15A,18A '-2026':14A,17A 'abap':3A 'crash':11A 'cve':13A,16A 'dispatch':6A 'exhaust':9A 'netweav':2A 'request':8A 'resourc':10A 'sap':1A 'servic':12A 'unauthent':7A 'web':5A","search_b":"'abap':19B,35B,36B 'applic':33B 'attack':53B 'certain':49B 'confidenti':69B 'consumpt':46B 'craft':56B 'dispatch':30B,41B 'disrupt':64B 'dos':20B 'drive':59B 'handl':44B 'host':25B 'impact':72B 'integr':71B 'netweav':21B,32B 'platform':37B 'proper':47B 'request':50B,57B 'resourc':45B,61B 'sap':22B,31B,39B 'self':24B 'self-host':23B 'send':55B 'server':34B 'servic':66B 'unauthent':26B,52B 'use':62B 'vendor':27B 'web':29B,40B 'web-dispatch':28B","search_c":"'abap':77C,78C 'affect':104C 'applic':75C 'attack':96C 'avail':120C 'caus':106C 'certain':92C 'compon':105C 'confidenti':126C 'consumpt':89C 'could':97C 'craft':100C 'dispatch':83C 'disrupt':112C 'excess':107C 'handl':87C 'high':117C 'impact':118C,124C 'integr':128C 'netweav':74C 'platform':79C 'process':91C 'request':93C,101C 'resourc':88C,108C 'result':114C 'sap':73C,81C 'send':98C 'server':76C 'servic':111C 'special':99C 'suffici':86C 'unauthent':95C 'util':109C 'web':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109794","severity":null,"published_at":"2026-11-10T01:17:13+00:00","modified_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109794:2394","url":null,"severity":null,"published_at":"2026-11-10T01:36:04+00:00","modified_at":"2026-11-10T01:36:04+00:00","first_seen_at":"2026-11-10T01:36:04+00:00","fetched_at":"2026-11-10T01:36:04+00:00","note":"SAP's own note (Nov 2026 Patch Day, SAP for Me login) and the support.sap.com November page were not readable; no primary page found with affected kernel/Web Dispatcher versions or fix. Nothing verified. Left versions unknown; needs the SAP Security Note via SAP for Me."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}