CVE-2026-109805 · Vendor
NO FIX YET
SAP NetWeaver and ABAP Platform compute a weak HMAC when receiving RFC callbacks between application servers. An attacker with high privileges on the network path between application servers can intercept traffic, change the caller's identity, and run unauthorized function calls with escalated privileges.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver or ABAP Platform application servers where RFC callbacks flow between application servers. The attacker needs high privileges and access to a network segment between those servers, so the exposure is mainly internal network segmentation. The sources do not list affected versions or a fix.
Not affected if no-multi-app-server-network-exposure
Who cares abap-platform, netweaver, rfc, sap
Unknown from the sources.
No fix yet, per the sources.
Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.
This page as .md · .json · CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.