CVE-2026-109811 · Vendor
NO FIX YET
An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform makes server-side requests on insecure default settings. An authenticated attacker with low privileges can get a victim to contact a malicious server, exposing the victim's sensitive information and allowing limited changes to non-sensitive data.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP NetWeaver and ABAP Platform (Application Server ABAP) installations are the affected systems. The sources do not say which releases or patch levels are vulnerable, or which default settings are insecure.
Who cares abap, netweaver, sap
Unknown from the sources.
No fix yet, per the sources.
An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.