{"id":"CVE-2026-109795","kind":"vulnerability","aliases":["CVE-2026-109795"],"related":[],"title":"SAP NetWeaver: missing authorization checks let low-privilege users run code","description":"SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.","summary":"SAP NetWeaver lacks necessary authorization checks and input validation in certain remote-enabled functionality. An attacker with low privileges can send crafted input over a remote interface to execute arbitrary code on the affected system.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"S4CRM","fixed":[],"affected":"204, 205, 206","ecosystem":"vendor"},{"name":"S4CEXT","fixed":[],"affected":"107, 108, 109","ecosystem":"vendor"},{"name":"BBPCRM","fixed":[],"affected":"713, 714","ecosystem":"vendor"}],"ecosystems":[],"tags":["bbpcrm","netweaver","runtime","s4crm","sap","self-hosted"],"not_affected_if":[],"how_to_check":"Per the CVE record mirror, check whether you run SAP CRM components S4CRM 204/205/206, S4CEXT 107/108/109 or BBPCRM 713/714 (SAP GUI: System > Status > Component information, or transaction SPAM/SAINT). Then open SAP Note 3834842 on me.sap.com to confirm affected support packages and the correction.","fix":"Apply the correction in SAP Security Note 3834842 (me.sap.com/notes/3834842). Exact support package levels not read.","status":"open","published_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:13+00:00","updated_at":"2026-11-10T01:31:26+00:00","category":"runtime","confidence":0.55,"triage":{"at":"2026-11-10T01:28:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver: missing authorization checks let low-privilege users run code","impact":"high","summary":"SAP NetWeaver lacks necessary authorization checks and input validation in certain remote-enabled functionality. An attacker with low privileges can send crafted input over a remote interface to execute arbitrary code on the affected system.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap","netweaver","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary code runs on the SAP system, reaching beyond the component","analyst_note":"Find the SAP Security Note and affected NetWeaver releases for CVE-2026-109795 on the SAP Support Portal; sources give no versions or check steps.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running SAP NetWeaver with the remote-enabled functionality reachable by low-privilege users. The sources do not name the affected releases or the specific remote interface, so the exposed component cannot be confirmed from them.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000686,"input_tokens":4588,"output_tokens":455,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the SAP Security Note and affected NetWeaver releases for CVE-2026-109795 on the SAP Support Portal; sources give no versions or check steps.","search":"'-109795':15A,18A '-2026':14A,17A 'affect':64B,107C 'arbitrari':60B,103C 'attack':46B,86C,114C 'author':4A,34B,72C 'avail':130C 'bbpcrm':21A,22B 'beyond':117C 'certain':40B,80C 'check':5A,35B,73C 'code':12A,61B,104C 'compon':120C 'confidenti':127C 'could':90C,111C 'craft':52B,93C 'cve':13A,16A 'enabl':43B,83C 'execut':59B,102C 'exploit':110C 'extend':112C 'function':44B,84C 'high':124C 'host':29B 'impact':125C 'inject':100C 'input':37B,53B,77C,94C 'integr':128C 'interfac':57B,98C 'lack':32B,75C 'let':6A 'low':8A,48B,88C 'low-privileg':7A 'miss':3A 'necessari':33B,71C 'netweav':2A,23B,31B,67C 'perform':70C 'privileg':9A,49B,89C 'reach':116C 'remot':42B,56B,82C,97C 'remote-en':41B,81C 'result':121C 'run':11A 'runtim':24B 's4cext':20A 's4crm':19A,25B 'sap':1A,26B,30B,66C 'self':28B 'self-host':27B 'send':51B,91C 'special':92C 'success':109C 'suffici':76C 'system':65B,108C 'user':10A 'valid':38B,78C 'vulner':119C 'within':105C","nicknames":[],"mitigations":[],"who_affected":"SAP customers running the CRM-related add-ons S4CRM (204-206), S4CEXT (107-109) or BBPCRM (713-714) on NetWeaver, per a CVE-record mirror; SAP's own note was not readable. A low-privilege user with network access to a remote-enabled function can run code (CVSS 9.9, scope changed). Systems without these components can likely skip it, but confirm in the SAP note.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bbpcrm","s4cext","s4crm"],"ptokens":["bbpcrm","s4cext","s4crm"],"labels":["bbpcrm","critical","netweaver","runtime","s4crm","sap","selfhosted"],"campaign_type":null,"search_a":"'-109795':15A,18A '-2026':14A,17A 'author':4A 'bbpcrm':21A 'check':5A 'code':12A 'cve':13A,16A 'let':6A 'low':8A 'low-privileg':7A 'miss':3A 'netweav':2A 'privileg':9A 'run':11A 's4cext':20A 's4crm':19A 'sap':1A 'user':10A","search_b":"'affect':64B 'arbitrari':60B 'attack':46B 'author':34B 'bbpcrm':22B 'certain':40B 'check':35B 'code':61B 'craft':52B 'enabl':43B 'execut':59B 'function':44B 'host':29B 'input':37B,53B 'interfac':57B 'lack':32B 'low':48B 'necessari':33B 'netweav':23B,31B 'privileg':49B 'remot':42B,56B 'remote-en':41B 'runtim':24B 's4crm':25B 'sap':26B,30B 'self':28B 'self-host':27B 'send':51B 'system':65B 'valid':38B","search_c":"'affect':107C 'arbitrari':103C 'attack':86C,114C 'author':72C 'avail':130C 'beyond':117C 'certain':80C 'check':73C 'code':104C 'compon':120C 'confidenti':127C 'could':90C,111C 'craft':93C 'enabl':83C 'execut':102C 'exploit':110C 'extend':112C 'function':84C 'high':124C 'impact':125C 'inject':100C 'input':77C,94C 'integr':128C 'interfac':98C 'lack':75C 'low':88C 'necessari':71C 'netweav':67C 'perform':70C 'privileg':89C 'reach':116C 'remot':82C,97C 'remote-en':81C 'result':121C 'sap':66C 'send':91C 'special':92C 'success':109C 'suffici':76C 'system':108C 'valid':78C 'vulner':119C 'within':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109795","severity":null,"published_at":"2026-11-10T01:17:13+00:00","modified_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109795:2378","url":"https://hol.org/guard/security/cves/CVE-2026-109795-missing-authorization-check-in-s4crm","severity":null,"published_at":"2026-11-10T01:31:26+00:00","modified_at":"2026-11-10T01:31:26+00:00","first_seen_at":"2026-11-10T01:31:26+00:00","fetched_at":"2026-11-10T01:31:26+00:00","note":"SAP note 3834842 (me.sap.com, login-walled; Nov 2026 patch day page not yet published) is the primary; not read. Affected components from a CVE-list mirror (HOL) only: S4CRM 204-206, S4CEXT 107-109, BBPCRM 713-714. Nothing verified. Fix is SAP note 3834842 (no component versions known).","cites":["https://hol.org/guard/security/cves/CVE-2026-109795-missing-authorization-check-in-s4crm"]}],"documents":[{"id":112446,"url":"https://hol.org/guard/security/cves/CVE-2026-109795-missing-authorization-check-in-s4crm","title":"HOL Guard: CVE-2026-109795 (S4CRM) record mirroring CVE List","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}