---
id: "CVE-2026-109805"
page: "https://infrastack.ai/live/CVE-2026-109805"
kind: "vulnerability"
aliases: ["CVE-2026-109805"]
title: "SAP NetWeaver: weak HMAC on RFC callbacks lets an attacker impersonate servers"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["abap-platform", "netweaver", "rfc", "sap", "vendor"]
not_affected_if: ["no-multi-app-server-network-exposure"]
published_at: "2026-11-10T01:17:14+00:00"
first_seen_at: "2026-11-10T01:26:38+00:00"
updated_at: "2026-11-10T01:28:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109805", "first_seen_at": "2026-11-10T01:26:38+00:00"}]
exploit_sources: []
---

# SAP NetWeaver: weak HMAC on RFC callbacks lets an attacker impersonate servers

Link for people: https://infrastack.ai/live/CVE-2026-109805 (this .md is for agents)

SAP NetWeaver and ABAP Platform compute a weak HMAC when receiving RFC callbacks between application servers. An attacker with high privileges on the network path between application servers can intercept traffic, change the caller's identity, and run unauthorized function calls with escalated privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109805

## From the sources

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_