{"id":"CVE-2026-109811","kind":"vulnerability","aliases":["CVE-2026-109811"],"related":[],"title":"SAP NetWeaver ABAP HTTP component lets attackers reach internal services","description":"An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.","summary":"An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform makes server-side requests on insecure default settings. An authenticated attacker with low privileges can get a victim to contact a malicious server, exposing the victim's sensitive information and allowing limited changes to non-sensitive data.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abap","netweaver","sap","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:28:43+00:00","updated_at":"2026-11-10T01:28:43+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T01:28:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP HTTP component lets attackers reach internal services","impact":"medium","summary":"An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform makes server-side requests on insecure default settings. An authenticated attacker with low privileges can get a victim to contact a malicious server, exposing the victim's sensitive information and allowing limited changes to non-sensitive data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Victim's sensitive data exposed; limited non-sensitive data modified","analyst_note":"Find SAP's security note for CVE-2026-109811 to get affected releases, fixed patch levels and the insecure default setting to change.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"SAP NetWeaver and ABAP Platform (Application Server ABAP) installations are the affected systems. The sources do not say which releases or patch levels are vulnerable, or which default settings are insecure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4619,"output_tokens":468,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109811':13A,16A '-2026':12A,15A 'abap':3A,17B,23B,30B,73C,80C,84C 'access':114C 'allow':63B,110C 'applic':82C 'attack':7A,43B,95C,112C 'authent':42B,94C 'avail':141C 'belong':117C 'chang':65B 'compon':5A,25B,75C 'confidenti':135C 'contact':52B 'could':99C 'cve':11A,14A 'data':70B 'default':39B,91C 'due':88C 'expos':56B 'get':48B 'high':132C 'http':4A,24B,74C 'impact':133C,138C,144C 'inform':61B,116C,127C 'insecur':38B,90C 'integr':140C 'interact':104C 'intern':9A,22B,72C 'let':6A 'limit':64B,123C 'low':45B,97C,137C 'make':32B 'malici':54B,107C 'modifi':122C 'netweav':2A,18B,28B,78C 'non':68B,125C 'non-sensit':67B,124C 'platform':31B,81C 'privileg':46B,98C 'reach':8A 'request':36B 'result':129C 'sap':1A,19B,27B,77C 'sensit':60B,69B,115C,126C 'server':34B,55B,83C,108C 'server-sid':33B 'servic':10A 'set':40B,92C 'side':35B 'ssrf':86C 'trick':100C 'vendor':20B 'victim':50B,58B,102C,120C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver and ABAP Platform (Application Server ABAP) installations are the affected systems. The sources do not say which releases or patch levels are vulnerable, or which default settings are insecure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abap","medium","netweaver","sap","vendor"],"campaign_type":null,"search_a":"'-109811':13A,16A '-2026':12A,15A 'abap':3A 'attack':7A 'compon':5A 'cve':11A,14A 'http':4A 'intern':9A 'let':6A 'netweav':2A 'reach':8A 'sap':1A 'servic':10A","search_b":"'abap':17B,23B,30B 'allow':63B 'attack':43B 'authent':42B 'chang':65B 'compon':25B 'contact':52B 'data':70B 'default':39B 'expos':56B 'get':48B 'http':24B 'inform':61B 'insecur':38B 'intern':22B 'limit':64B 'low':45B 'make':32B 'malici':54B 'netweav':18B,28B 'non':68B 'non-sensit':67B 'platform':31B 'privileg':46B 'request':36B 'sap':19B,27B 'sensit':60B,69B 'server':34B,55B 'server-sid':33B 'set':40B 'side':35B 'vendor':20B 'victim':50B,58B","search_c":"'abap':73C,80C,84C 'access':114C 'allow':110C 'applic':82C 'attack':95C,112C 'authent':94C 'avail':141C 'belong':117C 'compon':75C 'confidenti':135C 'could':99C 'default':91C 'due':88C 'high':132C 'http':74C 'impact':133C,138C,144C 'inform':116C,127C 'insecur':90C 'integr':140C 'interact':104C 'intern':72C 'limit':123C 'low':97C,137C 'malici':107C 'modifi':122C 'netweav':78C 'non':125C 'non-sensit':124C 'platform':81C 'privileg':98C 'result':129C 'sap':77C 'sensit':115C,126C 'server':83C,108C 'set':92C 'ssrf':86C 'trick':100C 'victim':102C,120C 'vulner':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109811","severity":null,"published_at":"2026-11-10T01:17:15+00:00","modified_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}