{"id":"CVE-2026-109807","kind":"vulnerability","aliases":["CVE-2026-109807"],"related":[],"title":"SAP NetWeaver Internet Graphics Service: crafted request lets an unauthenticated attacker repeatedly crash the worker (integer overflow)","description":"SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.","summary":"SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request makes it read past declared values. An unauthenticated attacker can repeatedly terminate the worker process, causing a denial of service with no confidentiality or integrity impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver Internet Graphics Service","fixed":[],"affected":"7.20_EXT2 - 9.16 (per CVE record via OffSeq; unconfirmed on SAP note)","ecosystem":"vendor"}],"ecosystems":[],"tags":["dos","igs","netweaver","sap","self-hosted","vendor"],"not_affected_if":["igs-not-installed"],"how_to_check":"- Check whether the Internet Graphics Service (IGS) is installed and running on your SAP NetWeaver landscape (including IGS reachable from the network).\n- Open SAP Security Note 3809934 in SAP for Me (login required) and compare your IGS/NetWeaver patch level with its affected and corrected releases. Per a third-party summary of the CVE record the affected range is 7.20_EXT2 to 9.16; not confirmed on SAP's own page.","fix":null,"status":"open","published_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:28:35+00:00","updated_at":"2026-11-10T01:34:48+00:00","category":"vendor","confidence":0.55,"triage":{"at":"2026-11-10T01:28:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver: crafted request repeatedly crashes Internet Graphics Service worker","impact":"low","summary":"SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request makes it read past declared values. An unauthenticated attacker can repeatedly terminate the worker process, causing a denial of service with no confidentiality or integrity impact.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Repeated worker crashes make the graphics service unavailable","analyst_note":"Find SAP's security note for CVE-2026-109807 to get affected releases and the patch version; the NVD entry does not list them.","how_to_check":"- Check whether SAP NetWeaver with the Internet Graphics Service (ICM/IGS) is deployed, for example by confirming the IGS component is installed on the system.\n- Check the installed SAP NetWeaver support package and patch level against SAP's security note for this CVE; the sources do not name the affected release range.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["igs-not-installed"],"who_is_affected":"SAP NetWeaver systems that run the Internet Graphics Service and accept HTTP requests from the network are the exposed ones. The sources do not list the affected release range, so check your SAP patch level against SAP's security notes. Systems without the Internet Graphics Service can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4567,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note for CVE-2026-109807 to get affected releases and the patch version; the NVD entry does not list them.","search":"'-109807':20A,23A '-2026':19A,22A 'affect':105C 'attack':11A,61B 'avail':128C 'beyond':109C 'caus':68B,103C 'certain':46B,88C 'confidenti':75B,135C 'could':97C 'craft':6A,51B,101C 'crash':13A 'cve':18A,21A 'declar':57B,111C 'denial':70B 'dos':29B 'graphic':4A,41B,82C 'graphics':27A 'high':125C 'host':35B 'ig':30B 'impact':78B,126C,131C 'incom':92C 'input':47B,89C 'integ':16A 'integr':77B,133C 'internet':3A,26A,40B,81C 'let':8A 'make':53B 'netweav':2A,31B,38B,80C 'netweaver':25A 'overflow':17A 'past':56B 'process':67B,106C,120C 'read':55B,108C 'repeat':12A,63B,115C 'request':7A,52B,93C,102C 'result':113C,122C 'sap':1A,24A,32B,37B,79C 'self':34B 'self-host':33B 'send':98C 'servic':5A,42B,72B,83C 'service':28A 'special':100C 'suffici':86C 'termin':64B,116C 'unauthent':10A,60B,95C 'user':96C 'valid':45B,87C 'valu':48B,58B,90C,112C 'vendor':36B 'within':91C 'worker':15A,66B,119C","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver systems that run the Internet Graphics Service and accept HTTP requests from the network are the exposed ones. The sources do not list the affected release range, so check your SAP patch level against SAP's security notes. Systems without the Internet Graphics Service can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverinternetgraphicsservice","sapnetweaverinternetgraphicsservice"],"ptokens":["graphics","internet","netweaver","sap","service"],"labels":["dos","high","igs","netweaver","sap","selfhosted","vendor"],"campaign_type":null,"search_a":"'-109807':20A,23A '-2026':19A,22A 'attack':11A 'craft':6A 'crash':13A 'cve':18A,21A 'graphic':4A 'graphics':27A 'integ':16A 'internet':3A,26A 'let':8A 'netweav':2A 'netweaver':25A 'overflow':17A 'repeat':12A 'request':7A 'sap':1A,24A 'servic':5A 'service':28A 'unauthent':10A 'worker':15A","search_b":"'attack':61B 'caus':68B 'certain':46B 'confidenti':75B 'craft':51B 'declar':57B 'denial':70B 'dos':29B 'graphic':41B 'host':35B 'ig':30B 'impact':78B 'input':47B 'integr':77B 'internet':40B 'make':53B 'netweav':31B,38B 'past':56B 'process':67B 'read':55B 'repeat':63B 'request':52B 'sap':32B,37B 'self':34B 'self-host':33B 'servic':42B,72B 'termin':64B 'unauthent':60B 'valid':45B 'valu':48B,58B 'vendor':36B 'worker':66B","search_c":"'affect':105C 'avail':128C 'beyond':109C 'caus':103C 'certain':88C 'confidenti':135C 'could':97C 'craft':101C 'declar':111C 'graphic':82C 'high':125C 'impact':126C,131C 'incom':92C 'input':89C 'integr':133C 'internet':81C 'netweav':80C 'process':106C,120C 'read':108C 'repeat':115C 'request':93C,102C 'result':113C,122C 'sap':79C 'send':98C 'servic':83C 'special':100C 'suffici':86C 'termin':116C 'unauthent':95C 'user':96C 'valid':87C 'valu':90C,112C 'within':91C 'worker':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109807","severity":null,"published_at":"2026-11-10T01:17:15+00:00","modified_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109807:2389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109807","severity":null,"published_at":"2026-11-10T01:34:48+00:00","modified_at":"2026-11-10T01:34:48+00:00","first_seen_at":"2026-11-10T01:34:48+00:00","fetched_at":"2026-11-10T01:34:48+00:00","note":"SAP note 3809934 (me.sap.com, login-walled) is the primary source; could not read it. Patch Day Nov 2026 page not available. Affected range 7.20_EXT2-9.16 from OffSeq's copy of the CVE record; fixed version unknown. CWE-190, CVSS 7.5, no exploitation or PoC found. Nothing marked verified. Settle by reading note 3809934.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-109807","https://radar.offseq.com/threat/cve-2026-109807-cwe-190-integer-overflow-or-wraparound-in-sapse-sap-netweaver-internet-graphics-service-5aa7c1ae0246e697"]}],"documents":[{"id":112464,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109807","title":"NVD: CVE-2026-109807 (CNA: SAP SE)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112465,"url":"https://radar.offseq.com/threat/cve-2026-109807-cwe-190-integer-overflow-or-wraparound-in-sapse-sap-netweaver-internet-graphics-service-5aa7c1ae0246e697","title":"OffSeq Threat Radar: CVE-2026-109807","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}