{"id":"CVE-2026-109802","kind":"vulnerability","aliases":["CVE-2026-109802"],"related":[],"title":"SAP NetWeaver ABAP: crafted input crashes work process, system unavailable","description":"SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.","summary":"SAP NetWeaver Application Server for ABAP does not validate certain input values properly. An authenticated user can send crafted requests that crash the affected work process and make the system unavailable.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abap","netweaver","sap","vendor"],"not_affected_if":["no-authenticated-users","no-sap-netweaver-abap"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","triaged_at":"2026-11-10T01:28:46+00:00","updated_at":"2026-11-10T01:28:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T01:28:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP: crafted input crashes work process, system unavailable","impact":"low","summary":"SAP NetWeaver Application Server for ABAP does not validate certain input values properly. An authenticated user can send crafted requests that crash the affected work process and make the system unavailable.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Work process crashes, causing denial of service on the SAP system","analyst_note":"Find the SAP security note for CVE-2026-109802 and list the affected releases and fixed patch levels; the NVD entry does not give them.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sap-netweaver-abap","no-authenticated-users"],"who_is_affected":"Organisations running SAP NetWeaver Application Server for ABAP where users hold valid accounts. The sources do not name affected SAP releases or patch levels, so the team should check SAP's security note for this CVE against its own system versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":4543,"output_tokens":451,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109802':13A,16A '-2026':12A,15A 'abap':3A,17B,26B,57C 'affect':44B,84C 'applic':23B,54C 'authent':35B,66C 'avail':99C 'certain':30B,62C 'confidenti':104C 'could':68C,81C 'craft':4A,39B,71C 'crash':6A,42B,82C 'cve':11A,14A 'error':76C 'high':96C 'impact':97C,102C 'input':5A,31B,63C 'integr':106C 'intern':78C 'make':48B,88C 'netweav':2A,18B,22B,53C 'process':8A,46B,79C,86C 'proper':33B,60C 'request':40B,72C 'result':93C 'sap':1A,19B,21B,52C 'send':38B,69C 'server':24B,55C 'special':70C 'system':9A,50B,90C 'trigger':74C 'unavail':10A,51B,91C 'user':36B,67C 'valid':29B,61C 'valu':32B,64C 'vendor':20B 'work':7A,45B,85C","nicknames":[],"mitigations":[],"who_affected":"Organisations running SAP NetWeaver Application Server for ABAP where users hold valid accounts. The sources do not name affected SAP releases or patch levels, so the team should check SAP's security note for this CVE against its own system versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abap","medium","netweaver","sap","vendor"],"campaign_type":null,"search_a":"'-109802':13A,16A '-2026':12A,15A 'abap':3A 'craft':4A 'crash':6A 'cve':11A,14A 'input':5A 'netweav':2A 'process':8A 'sap':1A 'system':9A 'unavail':10A 'work':7A","search_b":"'abap':17B,26B 'affect':44B 'applic':23B 'authent':35B 'certain':30B 'craft':39B 'crash':42B 'input':31B 'make':48B 'netweav':18B,22B 'process':46B 'proper':33B 'request':40B 'sap':19B,21B 'send':38B 'server':24B 'system':50B 'unavail':51B 'user':36B 'valid':29B 'valu':32B 'vendor':20B 'work':45B","search_c":"'abap':57C 'affect':84C 'applic':54C 'authent':66C 'avail':99C 'certain':62C 'confidenti':104C 'could':68C,81C 'craft':71C 'crash':82C 'error':76C 'high':96C 'impact':97C,102C 'input':63C 'integr':106C 'intern':78C 'make':88C 'netweav':53C 'process':79C,86C 'proper':60C 'request':72C 'result':93C 'sap':52C 'send':69C 'server':55C 'special':70C 'system':90C 'trigger':74C 'unavail':91C 'user':67C 'valid':61C 'valu':64C 'work':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109802","severity":null,"published_at":"2026-11-10T01:17:14+00:00","modified_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","fetched_at":"2026-11-10T01:26:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}