{"id":"CVE-2026-109803","kind":"vulnerability","aliases":["CVE-2026-109803"],"related":[],"title":"SAP NetWeaver Knowledge Management: XSL transformation selection allows code execution","description":"SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.","summary":"SAP NetWeaver Knowledge Management's XML Forms feature does not restrict which XSL transformations get processed. An authenticated user with access to that feature can trigger an unauthorized transformation, which can lead to arbitrary code execution in the application context.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authenticated","enterprise","knowledge-management","netweaver","sap","vendor","xml-forms"],"not_affected_if":["no-netweaver-km","xml-forms-unused"],"how_to_check":"- Check whether SAP NetWeaver Knowledge Management (Java stack) with XML Forms is deployed and in use\\n- In SAP for Me, search Security Notes for CVE-2026-109803 and compare your KM/XML Forms component support package level with the note's affected range","fix":null,"status":"open","published_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","triaged_at":"2026-11-10T01:28:11+00:00","updated_at":"2026-11-10T01:31:30+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T01:28:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver Knowledge Management: XSL transformation selection allows code execution","impact":"high","summary":"SAP NetWeaver Knowledge Management's XML Forms feature does not restrict which XSL transformations get processed. An authenticated user with access to that feature can trigger an unauthorized transformation, which can lead to arbitrary code execution in the application context.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","enterprise"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs in application context; data read or altered","analyst_note":"Find the SAP Security Note and affected release ranges for CVE-2026-109803 to confirm fixed versions and conditions.","how_to_check":"- Confirm whether SAP NetWeaver Knowledge Management with XML Forms is deployed in your SAP landscape\n- Check the SAP Security Notes for CVE-2026-109803 in the SAP Support Portal\n- unknown for specific affected release versions","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["xml-forms-unused","no-netweaver-km"],"who_is_affected":"Organizations running SAP NetWeaver Knowledge Management with the XML Forms functionality enabled are exposed. The attacker must hold an authenticated account with access to that functionality. Systems without NetWeaver Knowledge Management or XML Forms are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000742,"input_tokens":4603,"output_tokens":564,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the SAP Security Note and affected release ranges for CVE-2026-109803 to confirm fixed versions and conditions.","search":"'-109803':13A,16A '-2026':12A,15A 'access':48B,95C 'affect':86C,98C 'allow':8A 'applic':66B,117C,130C 'arbitrari':61B,112C 'authent':17B,45B,92C 'avail':127C 'caus':101C 'certain':89C 'code':9A,62B,113C 'condit':90C 'confidenti':124C 'context':67B,118C 'could':100C,121C 'cve':11A,14A 'enterpris':18B 'execut':10A,63B,114C 'exploit':120C 'featur':35B,51B 'form':27B,34B,73C 'function':87C,99C 'get':42B 'impact':122C 'integr':125C 'knowledg':3A,20B,30B,70C 'knowledge-manag':19B 'lead':59B,110C 'manag':4A,21B,31B,71C 'netweav':2A,22B,29B,69C 'potenti':109C 'process':43B,83C,108C 'restrict':38B,77C 'sap':1A,23B,28B,68C 'select':7A,79C 'success':119C 'suffici':76C 'transform':6A,41B,56B,82C,105C 'trigger':53B 'unauthor':55B,103C 'user':46B,93C 'vendor':24B 'xml':26B,33B,72C 'xml-form':25B 'xsl':5A,40B,81C,104C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver Knowledge Management with the XML Forms functionality enabled are exposed. The attacker must hold an authenticated account with access to that functionality. Systems without NetWeaver Knowledge Management or XML Forms are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authenticated","critical","enterprise","knowledgemanagement","netweaver","sap","vendor","xmlforms"],"campaign_type":null,"search_a":"'-109803':13A,16A '-2026':12A,15A 'allow':8A 'code':9A 'cve':11A,14A 'execut':10A 'knowledg':3A 'manag':4A 'netweav':2A 'sap':1A 'select':7A 'transform':6A 'xsl':5A","search_b":"'access':48B 'applic':66B 'arbitrari':61B 'authent':17B,45B 'code':62B 'context':67B 'enterpris':18B 'execut':63B 'featur':35B,51B 'form':27B,34B 'get':42B 'knowledg':20B,30B 'knowledge-manag':19B 'lead':59B 'manag':21B,31B 'netweav':22B,29B 'process':43B 'restrict':38B 'sap':23B,28B 'transform':41B,56B 'trigger':53B 'unauthor':55B 'user':46B 'vendor':24B 'xml':26B,33B 'xml-form':25B 'xsl':40B","search_c":"'access':95C 'affect':86C,98C 'applic':117C,130C 'arbitrari':112C 'authent':92C 'avail':127C 'caus':101C 'certain':89C 'code':113C 'condit':90C 'confidenti':124C 'context':118C 'could':100C,121C 'execut':114C 'exploit':120C 'form':73C 'function':87C,99C 'impact':122C 'integr':125C 'knowledg':70C 'lead':110C 'manag':71C 'netweav':69C 'potenti':109C 'process':83C,108C 'restrict':77C 'sap':68C 'select':79C 'success':119C 'suffici':76C 'transform':82C,105C 'unauthor':103C 'user':93C 'xml':72C 'xsl':81C,104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109803","severity":null,"published_at":"2026-11-10T01:17:14+00:00","modified_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","fetched_at":"2026-11-10T01:26:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109803:2376","url":null,"severity":null,"published_at":"2026-11-10T01:31:30+00:00","modified_at":"2026-11-10T01:31:30+00:00","first_seen_at":"2026-11-10T01:31:30+00:00","fetched_at":"2026-11-10T01:31:30+00:00","note":"SAP Security Note not publicly reachable (SAP for Me login; Nov 2026 patch day page not retrievable; NVD page did not load). No affected versions or fixed levels found, nothing verified. Settle by reading the SAP note for this CVE in SAP for Me. Fix left unknown."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}