---
id: "CVE-2026-109809"
page: "https://infrastack.ai/live/CVE-2026-109809"
kind: "vulnerability"
aliases: ["CVE-2026-109809"]
title: "SAP NetWeaver Java: NWDI Cockpit lets low-privilege users make unauthorized changes"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "SAP NetWeaver Application Server Java", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "netweaver", "nwdi-cockpit", "runtime", "sap"]
not_affected_if: ["no-low-privilege-users", "no-nwdi-cockpit"]
published_at: "2026-11-10T01:17:15+00:00"
first_seen_at: "2026-11-10T01:26:38+00:00"
updated_at: "2026-11-10T01:28:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109809", "first_seen_at": "2026-11-10T01:26:38+00:00"}]
exploit_sources: []
---

# SAP NetWeaver Java: NWDI Cockpit lets low-privilege users make unauthorized changes

Link for people: https://infrastack.ai/live/CVE-2026-109809 (this .md is for agents)

SAP NetWeaver Application Server Java's NWDI Cockpit skips authorization checks on certain functions before processing requests. An attacker with low privileges can make unauthorized modifications, with high integrity impact and no confidentiality or availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver Application Server Java affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T01:26:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109809

## From the sources

SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_