{"id":"CVE-2026-109805","kind":"vulnerability","aliases":["CVE-2026-109805"],"related":[],"title":"SAP NetWeaver: weak HMAC on RFC callbacks lets an attacker impersonate servers","description":"Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.","summary":"SAP NetWeaver and ABAP Platform compute a weak HMAC when receiving RFC callbacks between application servers. An attacker with high privileges on the network path between application servers can intercept traffic, change the caller's identity, and run unauthorized function calls with escalated privileges.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abap-platform","netweaver","rfc","sap","vendor"],"not_affected_if":["no-multi-app-server-network-exposure"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:28:48+00:00","updated_at":"2026-11-10T01:28:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T01:28:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver: weak HMAC on RFC callbacks lets an attacker impersonate servers","impact":"high","summary":"SAP NetWeaver and ABAP Platform compute a weak HMAC when receiving RFC callbacks between application servers. An attacker with high privileges on the network path between application servers can intercept traffic, change the caller's identity, and run unauthorized function calls with escalated privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap-platform","rfc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs unauthorized function calls with escalated privileges on the target server","analyst_note":"Check SAP Security Notes for CVE-2026-109805 for affected release ranges and the patch; the NVD entry gives no versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-multi-app-server-network-exposure"],"who_is_affected":"Organizations running SAP NetWeaver or ABAP Platform application servers where RFC callbacks flow between application servers. The attacker needs high privileges and access to a network segment between those servers, so the exposure is mainly internal network segmentation. The sources do not list affected versions or a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4621,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109805':15A,18A '-2026':14A,17A 'abap':20B,29B,86C,90C 'abap-platform':19B 'access':98C 'applic':40B,52B,88C,104C,115C,149C 'attack':10A,43B,93C 'authent':92C 'avail':146C 'calcul':76C 'call':66B,130C 'callback':7A,38B,81C 'caller':59B,123C 'chang':57B,118C 'communic':113C 'comput':31B 'confidenti':143C 'could':110C 'cryptographi':75C 'cve':13A,16A 'due':70C 'enabl':124C 'escal':68B,136C 'execut':126C 'function':65B,129C 'high':45B,95C,140C 'hmac':4A,34B,74C 'ident':61B,120C 'impact':141C 'imperson':11A 'integr':144C 'intercept':55B,111C 'lead':138C 'let':8A 'netweav':2A,22B,27B,84C 'network':49B,101C,112C 'path':50B 'platform':21B,30B,87C 'privileg':46B,69B,96C,137C 'receiv':36B,78C 'rfc':6A,23B,37B,80C 'run':63B 'sap':1A,24B,26B,83C,108C 'segment':102C 'server':12A,41B,53B,89C,105C,116C,134C 'system':109C 'target':133C 'traffic':56B 'unauthor':64B,128C 'vendor':25B 'weak':3A,33B,73C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver or ABAP Platform application servers where RFC callbacks flow between application servers. The attacker needs high privileges and access to a network segment between those servers, so the exposure is mainly internal network segmentation. The sources do not list affected versions or a fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abapplatform","medium","netweaver","rfc","sap","vendor"],"campaign_type":null,"search_a":"'-109805':15A,18A '-2026':14A,17A 'attack':10A 'callback':7A 'cve':13A,16A 'hmac':4A 'imperson':11A 'let':8A 'netweav':2A 'rfc':6A 'sap':1A 'server':12A 'weak':3A","search_b":"'abap':20B,29B 'abap-platform':19B 'applic':40B,52B 'attack':43B 'call':66B 'callback':38B 'caller':59B 'chang':57B 'comput':31B 'escal':68B 'function':65B 'high':45B 'hmac':34B 'ident':61B 'intercept':55B 'netweav':22B,27B 'network':49B 'path':50B 'platform':21B,30B 'privileg':46B,69B 'receiv':36B 'rfc':23B,37B 'run':63B 'sap':24B,26B 'server':41B,53B 'traffic':56B 'unauthor':64B 'vendor':25B 'weak':33B","search_c":"'abap':86C,90C 'access':98C 'applic':88C,104C,115C,149C 'attack':93C 'authent':92C 'avail':146C 'calcul':76C 'call':130C 'callback':81C 'caller':123C 'chang':118C 'communic':113C 'confidenti':143C 'could':110C 'cryptographi':75C 'due':70C 'enabl':124C 'escal':136C 'execut':126C 'function':129C 'high':95C,140C 'hmac':74C 'ident':120C 'impact':141C 'integr':144C 'intercept':111C 'lead':138C 'netweav':84C 'network':101C,112C 'platform':87C 'privileg':96C,137C 'receiv':78C 'rfc':80C 'sap':83C,108C 'segment':102C 'server':89C,105C,116C,134C 'system':109C 'target':133C 'unauthor':128C 'weak':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109805","severity":null,"published_at":"2026-11-10T01:17:14+00:00","modified_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}