{"id":"CVE-2026-109800","kind":"vulnerability","aliases":["CVE-2026-109800"],"related":[],"title":"SAP Web Dispatcher: crafted input crashes the proxy and backend systems","description":"SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application.","summary":"SAP Web Dispatcher does not validate certain inputs, which can cause memory corruption and terminate the process. An authenticated low-privilege user can send crafted input to take down the Web Dispatcher and every backend system reachable through it.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["sap","self-hosted","vendor","web-dispatcher"],"not_affected_if":["no-authenticated-users","no-web-dispatcher"],"how_to_check":"- Check the SAP Web Dispatcher release and patch level in the SAP system information or the `sapwebdisp -version` output\n- Compare against the SAP Security Note for this CVE, which the sources do not name: unknown","fix":null,"status":"open","published_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","triaged_at":"2026-11-10T01:28:19+00:00","updated_at":"2026-11-10T01:35:44+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T01:28:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP Web Dispatcher: crafted input crashes the proxy and backend systems","impact":"medium","summary":"SAP Web Dispatcher does not validate certain inputs, which can cause memory corruption and terminate the process. An authenticated low-privilege user can send crafted input to take down the Web Dispatcher and every backend system reachable through it.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","web-dispatcher","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Web Dispatcher crashes, taking all reachable backend systems offline","analyst_note":"Find the SAP Security Note and fixed Web Dispatcher releases for CVE-2026-109800 on the SAP support portal; the sources give no fix.","how_to_check":"- Check the SAP Web Dispatcher release and patch level in the SAP system information or the `sapwebdisp -version` output\n- Compare against the SAP Security Note for this CVE, which the sources do not name: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-web-dispatcher","no-authenticated-users"],"who_is_affected":"SAP systems that expose the Web Dispatcher to users who hold a non-administrative login. The sources describe a denial of service only, with no confidentiality or integrity impact. Teams that do not run SAP Web Dispatcher can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4610,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the SAP Security Note and fixed Web Dispatcher releases for CVE-2026-109800 on the SAP support portal; the sources give no fix.","search":"'-109800':14A,17A '-2026':13A,16A 'administr':88C 'applic':141C 'attack':82C 'authent':44B,83C 'avail':130C 'backend':10A,61B,117C 'becom':122C 'caus':36B,99C 'certain':32B,71C 'confidenti':136C 'corrupt':38B,80C 'could':76C,90C 'craft':4A,51B,97C 'crash':6A 'cve':12A,15A 'dispatch':3A,25B,28B,58B,66C,102C,114C 'everi':60B 'exploit':91C 'high':127C 'host':21B 'impact':128C,134C 'input':5A,33B,52B,72C,98C 'integr':138C 'interact':108C 'lead':77C,124C 'low':46B 'low-privileg':45B 'memori':37B,79C 'non':87C 'non-administr':86C 'privileg':47B 'process':42B,74C,103C 'provid':95C 'proxi':8A 'reachabl':63B,119C 'result':111C 'sap':1A,18B,26B,64C 'self':20B 'self-host':19B 'send':50B 'special':96C 'suffici':69C 'system':11A,62B,118C 'take':54B 'termin':40B,105C 'unavail':123C 'user':48B,89C,107C 'valid':31B,70C 'vendor':22B 'vulner':93C 'web':2A,24B,27B,57B,65C,101C,113C 'web-dispatch':23B 'without':106C","nicknames":[],"mitigations":[],"who_affected":"SAP systems that expose the Web Dispatcher to users who hold a non-administrative login. The sources describe a denial of service only, with no confidentiality or integrity impact. Teams that do not run SAP Web Dispatcher can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","sap","selfhosted","vendor","webdispatcher"],"campaign_type":null,"search_a":"'-109800':14A,17A '-2026':13A,16A 'backend':10A 'craft':4A 'crash':6A 'cve':12A,15A 'dispatch':3A 'input':5A 'proxi':8A 'sap':1A 'system':11A 'web':2A","search_b":"'authent':44B 'backend':61B 'caus':36B 'certain':32B 'corrupt':38B 'craft':51B 'dispatch':25B,28B,58B 'everi':60B 'host':21B 'input':33B,52B 'low':46B 'low-privileg':45B 'memori':37B 'privileg':47B 'process':42B 'reachabl':63B 'sap':18B,26B 'self':20B 'self-host':19B 'send':50B 'system':62B 'take':54B 'termin':40B 'user':48B 'valid':31B 'vendor':22B 'web':24B,27B,57B 'web-dispatch':23B","search_c":"'administr':88C 'applic':141C 'attack':82C 'authent':83C 'avail':130C 'backend':117C 'becom':122C 'caus':99C 'certain':71C 'confidenti':136C 'corrupt':80C 'could':76C,90C 'craft':97C 'dispatch':66C,102C,114C 'exploit':91C 'high':127C 'impact':128C,134C 'input':72C,98C 'integr':138C 'interact':108C 'lead':77C,124C 'memori':79C 'non':87C 'non-administr':86C 'process':74C,103C 'provid':95C 'reachabl':119C 'result':111C 'sap':64C 'special':96C 'suffici':69C 'system':118C 'termin':105C 'unavail':123C 'user':89C,107C 'valid':70C 'vulner':93C 'web':65C,101C,113C 'without':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109800","severity":null,"published_at":"2026-11-10T01:17:14+00:00","modified_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","fetched_at":"2026-11-10T01:26:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109800:2392","url":null,"severity":null,"published_at":"2026-11-10T01:35:44+00:00","modified_at":"2026-11-10T01:35:44+00:00","first_seen_at":"2026-11-10T01:35:44+00:00","fetched_at":"2026-11-10T01:35:44+00:00","note":"SAP's November 2026 patch-day page is not live yet (empty on 2026-11-10); no SAP note number, WEBDISP versions or fix found. Only NVD (CNA sap) and a third-party OffSeq page (CWE-121 stack overflow, no versions). Nothing verified. Revisit once the SAP Nov patch-day page is published; it would give note number, affected WEBDISP releases and fixed patch levels. Sibling: CVE-2026-89126."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}