CVE-2026-109803 · Vendor
NO FIX YET
SAP NetWeaver Knowledge Management's XML Forms feature does not restrict which XSL transformations get processed. An authenticated user with access to that feature can trigger an unauthorized transformation, which can lead to arbitrary code execution in the application context.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver Knowledge Management with the XML Forms functionality enabled are exposed. The attacker must hold an authenticated account with access to that functionality. Systems without NetWeaver Knowledge Management or XML Forms are not affected.
Not affected if no-netweaver-km, xml-forms-unused
Who cares authenticated, enterprise, knowledge-management, netweaver, sap, xml-forms
No fix yet, per the sources.
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.