---
id: "CVE-2026-109803"
page: "https://infrastack.ai/live/CVE-2026-109803"
kind: "vulnerability"
aliases: ["CVE-2026-109803"]
title: "SAP NetWeaver Knowledge Management: XSL transformation selection allows code execution"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["authenticated", "enterprise", "knowledge-management", "netweaver", "sap", "vendor", "xml-forms"]
not_affected_if: ["no-netweaver-km", "xml-forms-unused"]
published_at: "2026-11-10T01:17:14+00:00"
first_seen_at: "2026-11-10T01:26:37+00:00"
updated_at: "2026-11-10T01:31:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109803", "first_seen_at": "2026-11-10T01:26:37+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T01:31:30+00:00"}]
exploit_sources: []
---

# SAP NetWeaver Knowledge Management: XSL transformation selection allows code execution

Link for people: https://infrastack.ai/live/CVE-2026-109803 (this .md is for agents)

SAP NetWeaver Knowledge Management's XML Forms feature does not restrict which XSL transformations get processed. An authenticated user with access to that feature can trigger an unauthorized transformation, which can lead to arbitrary code execution in the application context.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether SAP NetWeaver Knowledge Management (Java stack) with XML Forms is deployed and in use\n- In SAP for Me, search Security Notes for CVE-2026-109803 and compare your KM/XML Forms component support package level with the note's affected range

## Timeline

- 2026-11-10T01:26:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109803
- 2026-11-10T01:31:30+00:00 analyst — SAP Security Note not publicly reachable (SAP for Me login; Nov 2026 patch day page not retrievable; NVD page did not load). No affected versions or fixed levels found, nothing verified. Settle by reading the SAP note for this CVE in SAP for Me. Fix left unknown.

## From the sources

SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_