---
id: "CVE-2026-109811"
page: "https://infrastack.ai/live/CVE-2026-109811"
kind: "vulnerability"
aliases: ["CVE-2026-109811"]
title: "SAP NetWeaver ABAP HTTP component lets attackers reach internal services"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["abap", "netweaver", "sap", "vendor"]
not_affected_if: []
published_at: "2026-11-10T01:17:15+00:00"
first_seen_at: "2026-11-10T01:26:38+00:00"
updated_at: "2026-11-10T01:28:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109811", "first_seen_at": "2026-11-10T01:26:38+00:00"}]
exploit_sources: []
---

# SAP NetWeaver ABAP HTTP component lets attackers reach internal services

Link for people: https://infrastack.ai/live/CVE-2026-109811 (this .md is for agents)

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform makes server-side requests on insecure default settings. An authenticated attacker with low privileges can get a victim to contact a malicious server, exposing the victim's sensitive information and allowing limited changes to non-sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109811

## From the sources

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_