Brief Summary: SAP NetWeaver CVE-2026-109795 Code Injection via Missing Authorization Check (CVSS 9.9)

Introduction

A newly published SAP vulnerability allows an authenticated user holding only low privileges to send crafted input through a remote interface and potentially execute arbitrary code inside the affected system. SAP rates it CVSS 3.1 9.9 with a changed scope, which means the documented impact can reach beyond the vulnerable component itself, with high consequences for confidentiality, integrity and availability.

The CVE record, assigned by SAP SE (the vendor field in the raw feed reads "Unknown"), is titled "Missing authorization check in S4CRM" and describes weaknesses in SAP NetWeaver functionality. As of publication on November 10, 2026, the available sources do not confirm exploitation in the wild, a public exploit, or any threat actor attribution. In this short review we separate what the record documents from what remains undisclosed.

Technical information

Root cause

The advisory describes two weaknesses acting together in certain remotely enabled functionality. The functionality does not perform the authorization checks it needs before acting on a request, and it does not adequately validate input arriving through the remote interface.

The combination lets a low-privileged attacker supply specially crafted input that results in code injection and execution. The CVE record does not explain the internal sequence connecting the two weaknesses, nor does it name the specific vulnerable function.

The weakness is classified as CWE-94, Improper Control of Generation of Code ('Code Injection'). MITRE defines this as constructing code using externally influenced input without correctly neutralizing elements that could alter the syntax or behavior of the intended code. That definition describes the weakness class. It does not tell us which SAP language construct, code generation operation or execution API is involved in this case.

CVSS vector

The exact CNA vector is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Under the FIRST CVSS v3.1 specification, a changed scope indicates that impact reaches a component beyond the vulnerable component. Combined with code execution, this is why the base score lands at 9.9 rather than in the lower critical range. NVD has not yet published its own assessment.

Attack flow

Based solely on the CNA description and vector, the documented attack model looks like this:

1. The attacker holds a low-privileged account or position on the SAP system (PR:L). This is a prerequisite, but given the impact it is not a meaningful barrier.
2. The attacker reaches the relevant remotely enabled functionality over the network (AV:N), with no user interaction required (UI:N).
3. Because the necessary authorization check is missing, the functionality accepts the request despite the caller's limited privileges.
4. The attacker submits specially crafted input. Insufficient validation allows that input to influence generated code (CWE-94).
5. The injected code executes within the affected system, with effects that can extend beyond the vulnerable component (S:C).

These are potential outcomes described by the CNA rather than results observed in an incident.

What is not disclosed

The accessible record does not identify the remote protocol, endpoint, function name, required role or authorization object, payload format, affected configuration, or the identity under which injected code runs. It also does not establish whether installations are reachable from the public internet. A network attack vector in CVSS should not be read as proof of public exposure. No reproducible exploitation procedure or exploit code appears in the referenced public record.

Affected systems and versions

The CVE record lists specific component releases rather than declaring every NetWeaver deployment affected:

The list identifies affected releases only. The record provides no mapping to fixed versions. SAP Note 3834842 contains the applicability details and correction instructions, but it requires SAP for Me authentication. We could not review its prerequisites or any workaround from public material.

Two points from SAP's public Security Notes guidance are relevant when planning remediation:

• SAP recommends implementing Security Note corrections as a priority and states that NetWeaver security fixes are also delivered through support packages. No support package is publicly identified as fixing this CVE.
• New high or very high severity fixes are generally delivered for support packages shipped within the preceding 24 months for products in Mainstream or Extended Maintenance, so maintenance status matters when obtaining corrections.

We found no verified firewall rule, configuration switch, permission change or temporary workaround specific to this vulnerability in the accessible sources. MITRE's CWE-94 guidance (avoiding dynamic code generation, accept known good input validation, strict allowlists, fuzzing and fault injection testing) applies to developers of the affected code. It is not a workaround customers can deploy.

Vendor security history

SAP publishes Security Notes on Security Patch Day, the second Tuesday of each month. Its vulnerability disclosure policy names the SAP Product Security Response Team as the coordination point for receipt, validation, assessment, remediation coordination, customer communication and disclosure.

The most relevant recent precedent is CVE-2025-31324. On April 24, 2025, SAP published a bulletin for this unauthenticated remote code execution flaw in the NetWeaver Visual Composer development server, which stemmed from a security policy bypass permitting potentially executable file uploads. CERT-FR reported that it was aware of several compromises, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 29, 2025, marking it as known to be used in ransomware campaigns.

We cite that case as context only. CVE-2025-31324 required no authentication and targeted a different component, while CVE-2026-109795 requires low privileges and lists S4CRM, S4CEXT and BBPCRM releases. Indicators, actors and payloads from the earlier incident should not be transferred to this vulnerability. The CISA KEV lookup for CVE-2026-109795 also did not return a reliable result either way, so we make no claim about its KEV status.

References

• NVD entry for CVE-2026-109795
• CVE Record: CVE-2026-109795
• NVD API record for CVE-2026-109795
• SAP Note 3834842 (SAP for Me sign in required)
• SAP Security Notes and News / Security Patch Day
• CWE-94: Improper Control of Generation of Code
• FIRST CVSS v3.1 Specification Document
• CISA KEV Catalog lookup for CVE-2026-109795
• CISA KEV Catalog entry for CVE-2025-31324
• CERT-FR alert on SAP NetWeaver (CERTFR-2025-ALE-005)
• Cyber Security Agency of Singapore: Critical Vulnerabilities in SAP NetWeaver
• SAP Vulnerability Disclosure Policy
• SAP: Report a Security Issue
• SAP Company Information
• SAP Corporate Fact Sheet
• IBM PartnerPlus directory: SAP SE