{"id":"CVE-2026-109804","kind":"vulnerability","aliases":["CVE-2026-109804"],"related":[],"title":"SAP Message Server: malformed requests let unauthenticated attackers read sensitive data","description":"SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.","summary":"SAP Message Server mishandles certain malformed requests, so an unauthenticated attacker can send crafted input. A successful attack lets them retrieve sensitive information, with no effect on integrity or availability.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP Message Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["message-server","netweaver","sap","unauthenticated","vendor"],"not_affected_if":[],"how_to_check":"Unknown until SAP publishes the Security Note (November 2026 Patch Day, 10 Nov 2026, SAP for Me). Check your Message Server kernel release against the note's affected list. Also check that the Message Server ports (36NN internal, 39NN) are not reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","triaged_at":"2026-11-10T01:28:37+00:00","updated_at":"2026-11-10T01:36:01+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-10T01:28:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP Message Server: malformed requests let unauthenticated attackers read sensitive data","impact":"medium","summary":"SAP Message Server mishandles certain malformed requests, so an unauthenticated attacker can send crafted input. A successful attack lets them retrieve sensitive information, with no effect on integrity or availability.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","message-server"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker retrieves sensitive information from the server","analyst_note":"Find the SAP Security Note and affected release list at https://nvd.nist.gov/vuln/detail/CVE-2026-109804 or SAP's security patch day notes.","how_to_check":"unknown","plain_action":"","product_name":"SAP Message Server","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":4547,"output_tokens":399,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the SAP Security Note and affected release list at https://nvd.nist.gov/vuln/detail/CVE-2026-109804 or SAP's security patch day notes.","search":"'-109804':14A,17A '-2026':13A,16A 'allow':84C 'attack':8A,38B,45B,75C,86C 'avail':57B,105C 'certain':32B,65C 'confidenti':97C 'could':69C,83C 'craft':41B,79C 'cve':12A,15A 'data':11A 'effect':53B 'exploit':82C 'handl':64C 'high':94C 'impact':95C,101C 'inform':50B,90C 'input':42B,80C 'integr':55B,103C 'let':6A,46B 'leverag':71C 'malform':4A,33B,66C 'messag':2A,22B,29B,59C 'message':19A 'message-serv':21B 'mishandl':31B 'netweav':24B 'proper':63C 'read':9A 'request':5A,34B,67C 'result':91C 'retriev':48B,88C 'sap':1A,18A,25B,28B,58C 'send':40B,77C 'sensit':10A,49B,89C 'server':3A,20A,23B,30B,60C 'special':78C 'success':44B,81C 'unauthent':7A,26B,37B,74C 'vendor':27B","nicknames":[],"mitigations":[],"who_affected":"SAP Message Server (SAP NetWeaver/ASCS) installations. The CVE record says an unauthenticated attacker with network access can send malformed requests and read sensitive data (confidentiality only, no integrity or availability impact). Affected releases are not yet published; treat any system whose Message Server port is reachable from untrusted networks as exposed. This is a different CVE from the September 2026 CVE-2026-58240.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["messageserver","sapmessageserver"],"ptokens":["message","sap","server"],"labels":["high","messageserver","netweaver","sap","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-109804':14A,17A '-2026':13A,16A 'attack':8A 'cve':12A,15A 'data':11A 'let':6A 'malform':4A 'messag':2A 'message':19A 'read':9A 'request':5A 'sap':1A,18A 'sensit':10A 'server':3A,20A 'unauthent':7A","search_b":"'attack':38B,45B 'avail':57B 'certain':32B 'craft':41B 'effect':53B 'inform':50B 'input':42B 'integr':55B 'let':46B 'malform':33B 'messag':22B,29B 'message-serv':21B 'mishandl':31B 'netweav':24B 'request':34B 'retriev':48B 'sap':25B,28B 'send':40B 'sensit':49B 'server':23B,30B 'success':44B 'unauthent':26B,37B 'vendor':27B","search_c":"'allow':84C 'attack':75C,86C 'avail':105C 'certain':65C 'confidenti':97C 'could':69C,83C 'craft':79C 'exploit':82C 'handl':64C 'high':94C 'impact':95C,101C 'inform':90C 'input':80C 'integr':103C 'leverag':71C 'malform':66C 'messag':59C 'proper':63C 'request':67C 'result':91C 'retriev':88C 'sap':58C 'send':77C 'sensit':89C 'server':60C 'special':78C 'success':81C 'unauthent':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109804","severity":null,"published_at":"2026-11-10T01:17:14+00:00","modified_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:37+00:00","fetched_at":"2026-11-10T01:26:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109804:2391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109804","severity":null,"published_at":"2026-11-10T01:36:01+00:00","modified_at":"2026-11-10T01:36:01+00:00","first_seen_at":"2026-11-10T01:36:01+00:00","fetched_at":"2026-11-10T01:36:01+00:00","note":"SAP's November 2026 Patch Day page and the Security Note are not yet published (the patch day is 10 Nov). The NVD page returned no text. Only the CVE description and CVSS 7.5 (AV:N/PR:N, C:H) from the CNA are known. No affected versions, fix or note number found. Not the same as CVE-2026-58240 (note 3759472). Revisit once SAP posts the November page.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-109804"]}],"documents":[{"id":112470,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109804","title":"NVD: CVE-2026-109804","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}