---
id: "CVE-2026-109794"
page: "https://infrastack.ai/live/CVE-2026-109794"
kind: "vulnerability"
aliases: ["CVE-2026-109794"]
title: "SAP NetWeaver ABAP and Web Dispatcher: unauthenticated requests exhaust resources, crash service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["abap", "dos", "netweaver", "sap", "self-hosted", "unauthenticated", "vendor", "web-dispatcher"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T01:17:13+00:00"
first_seen_at: "2026-11-10T01:26:36+00:00"
updated_at: "2026-11-10T01:36:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109794", "first_seen_at": "2026-11-10T01:26:36+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T01:36:04+00:00"}]
exploit_sources: []
---

# SAP NetWeaver ABAP and Web Dispatcher: unauthenticated requests exhaust resources, crash service

Link for people: https://infrastack.ai/live/CVE-2026-109794 (this .md is for agents)

SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher do not handle resource consumption properly for certain requests. An unauthenticated attacker can send crafted requests that drive up resource use and disrupt the service, with no confidentiality or integrity impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until SAP's note is read. Check the kernel release of each ABAP application server (SM51 or System > Status) and each SAP Web Dispatcher (sapwebdisp -v), then compare against the November 2026 SAP Security Note for CVE-2026-109794 in SAP for Me.

## Timeline

- 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109794
- 2026-11-10T01:36:04+00:00 analyst — SAP's own note (Nov 2026 Patch Day, SAP for Me login) and the support.sap.com November page were not readable; no primary page found with affected kernel/Web Dispatcher versions or fix. Nothing verified. Left versions unknown; needs the SAP Security Note via SAP for Me.

## From the sources

SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing excessive resource utilization and service disruption. This results in a high impact on availability. There is no impact on confidentiality and integrity.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_