---
id: "CVE-2026-109804"
page: "https://infrastack.ai/live/CVE-2026-109804"
kind: "vulnerability"
aliases: ["CVE-2026-109804"]
title: "SAP Message Server: malformed requests let unauthenticated attackers read sensitive data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP Message Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["message-server", "netweaver", "sap", "unauthenticated", "vendor"]
not_affected_if: []
published_at: "2026-11-10T01:17:14+00:00"
first_seen_at: "2026-11-10T01:26:37+00:00"
updated_at: "2026-11-10T01:36:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109804", "first_seen_at": "2026-11-10T01:26:37+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109804", "first_seen_at": "2026-11-10T01:36:01+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-109804"]}]
exploit_sources: []
---

# SAP Message Server: malformed requests let unauthenticated attackers read sensitive data

Link for people: https://infrastack.ai/live/CVE-2026-109804 (this .md is for agents)

SAP Message Server mishandles certain malformed requests, so an unauthenticated attacker can send crafted input. A successful attack lets them retrieve sensitive information, with no effect on integrity or availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP Message Server affected range not listed fixed no fixed version listed

## How to check

Unknown until SAP publishes the Security Note (November 2026 Patch Day, 10 Nov 2026, SAP for Me). Check your Message Server kernel release against the note's affected list. Also check that the Message Server ports (36NN internal, 39NN) are not reachable from untrusted networks.

## Timeline

- 2026-11-10T01:26:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109804
- 2026-11-10T01:36:01+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-109804 — SAP's November 2026 Patch Day page and the Security Note are not yet published (the patch day is 10 Nov). The NVD page returned no text. Only the CVE description and CVSS 7.5 (AV:N/PR:N, C:H) from the CNA are known. No affected versions, fix or note number found. Not the same as CVE-2026-58240 (note 3759472). Revisit once SAP posts the November page.

## Documents

- [describes] NVD: CVE-2026-109804 https://nvd.nist.gov/vuln/detail/CVE-2026-109804

## From the sources

SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_