{"id":"CVE-2026-109809","kind":"vulnerability","aliases":["CVE-2026-109809"],"related":[],"title":"SAP NetWeaver Java: NWDI Cockpit lets low-privilege users make unauthorized changes","description":"SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application.","summary":"SAP NetWeaver Application Server Java's NWDI Cockpit skips authorization checks on certain functions before processing requests. An attacker with low privileges can make unauthorized modifications, with high integrity impact and no confidentiality or availability impact.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver Application Server Java","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","netweaver","nwdi-cockpit","runtime","sap"],"not_affected_if":["no-low-privilege-users","no-nwdi-cockpit"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:28:45+00:00","updated_at":"2026-11-10T01:28:45+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T01:28:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver Java: NWDI Cockpit lets low-privilege users make unauthorized changes","impact":"medium","summary":"SAP NetWeaver Application Server Java's NWDI Cockpit skips authorization checks on certain functions before processing requests. An attacker with low privileges can make unauthorized modifications, with high integrity impact and no confidentiality or availability impact.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap","netweaver","java","nwdi-cockpit"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"unauthorized modifications to integrity-protected data in the application","analyst_note":"Find SAP's advisory and affected release list for CVE-2026-109809 via the NVD entry, and confirm the fixed patch level.","how_to_check":"unknown","plain_action":"","product_name":"SAP NetWeaver Application Server Java","needs_analyst":true,"not_affected_if":["no-nwdi-cockpit","no-low-privilege-users"],"who_is_affected":"Organizations running SAP NetWeaver Application Server Java with the NWDI Cockpit component exposed to users with low-privilege accounts. Systems without NWDI Cockpit or without low-privilege user access are not described as affected. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4571,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109809':16A,19A '-2026':15A,18A 'applic':34B,70C,117C 'application':22A 'attack':50B,89C 'author':41B,79C 'avail':66B,114C 'certain':44B,82C 'chang':13A 'check':42B,80C 'cockpit':5A,29B,39B,74C 'confidenti':64B,112C 'could':93C 'cve':14A,17A 'exploit':94C,101C 'function':45B,83C 'high':59B,104C 'impact':61B,67B,105C,110C 'integr':60B,107C 'java':3A,24A,25B,36B,72C 'let':6A 'low':8A,52B,91C 'low-privileg':7A 'make':11A,55B 'modif':57B,99C 'netweav':2A,26B,33B,69C 'netweaver':21A 'nwdi':4A,28B,38B,73C 'nwdi-cockpit':27B 'perform':77C,97C 'privileg':9A,53B,92C 'process':47B,85C 'request':48B,87C 'result':102C 'runtim':30B 'sap':1A,20A,31B,32B,68C 'server':23A,35B,71C 'skip':40B 'success':100C 'suffici':78C 'unauthor':12A,56B,98C 'user':10A","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver Application Server Java with the NWDI Cockpit component exposed to users with low-privilege accounts. Systems without NWDI Cockpit or without low-privilege user access are not described as affected. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverapplicationserverjava","sapnetweaverapplicationserverjava"],"ptokens":["application","java","netweaver","sap","server"],"labels":["java","medium","netweaver","nwdicockpit","runtime","sap","vendor"],"campaign_type":null,"search_a":"'-109809':16A,19A '-2026':15A,18A 'application':22A 'chang':13A 'cockpit':5A 'cve':14A,17A 'java':3A,24A 'let':6A 'low':8A 'low-privileg':7A 'make':11A 'netweav':2A 'netweaver':21A 'nwdi':4A 'privileg':9A 'sap':1A,20A 'server':23A 'unauthor':12A 'user':10A","search_b":"'applic':34B 'attack':50B 'author':41B 'avail':66B 'certain':44B 'check':42B 'cockpit':29B,39B 'confidenti':64B 'function':45B 'high':59B 'impact':61B,67B 'integr':60B 'java':25B,36B 'low':52B 'make':55B 'modif':57B 'netweav':26B,33B 'nwdi':28B,38B 'nwdi-cockpit':27B 'privileg':53B 'process':47B 'request':48B 'runtim':30B 'sap':31B,32B 'server':35B 'skip':40B 'unauthor':56B","search_c":"'applic':70C,117C 'attack':89C 'author':79C 'avail':114C 'certain':82C 'check':80C 'cockpit':74C 'confidenti':112C 'could':93C 'exploit':94C,101C 'function':83C 'high':104C 'impact':105C,110C 'integr':107C 'java':72C 'low':91C 'modif':99C 'netweav':69C 'nwdi':73C 'perform':77C,97C 'privileg':92C 'process':85C 'request':87C 'result':102C 'sap':68C 'server':71C 'success':100C 'suffici':78C 'unauthor':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109809","severity":null,"published_at":"2026-11-10T01:17:15+00:00","modified_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}