SAP NETWEAVER APPLICATION SERVER JAVA · CVE-2026-109809 · Runtime
NO FIX YET
SAP NetWeaver Application Server Java's NWDI Cockpit skips authorization checks on certain functions before processing requests. An attacker with low privileges can make unauthorized modifications, with high integrity impact and no confidentiality or availability impact.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver Application Server Java with the NWDI Cockpit component exposed to users with low-privilege accounts. Systems without NWDI Cockpit or without low-privilege user access are not described as affected. The sources do not list affected versions.
Not affected if no-low-privilege-users, no-nwdi-cockpit
Who cares java, netweaver, nwdi-cockpit, sap
Unknown from the sources.
No fix yet, per the sources.
SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.