---
id: "CVE-2026-109796"
page: "https://infrastack.ai/live/CVE-2026-109796"
kind: "vulnerability"
aliases: ["CVE-2026-109796"]
title: "SAP NetWeaver ABAP: uninitialized memory can leak to low-privileged users"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["abap", "netweaver", "sap", "vendor"]
not_affected_if: []
published_at: "2026-11-10T01:17:13+00:00"
first_seen_at: "2026-11-10T01:26:36+00:00"
updated_at: "2026-11-10T01:29:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109796", "first_seen_at": "2026-11-10T01:26:36+00:00"}]
exploit_sources: []
---

# SAP NetWeaver ABAP: uninitialized memory can leak to low-privileged users

Link for people: https://infrastack.ai/live/CVE-2026-109796 (this .md is for agents)

SAP NetWeaver Application Server ABAP and ABAP Platform fail to initialize memory in certain internal components. An attacker with low privileges can read uninitialized memory contents under specific conditions, exposing limited data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109796

## From the sources

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_