Overview of CVE-2026-109803: SAP NetWeaver Knowledge Management XML Forms XSL Transformation Code Injection (CVSS 9.9)

Introduction

SAP has disclosed a code injection flaw in the XML Forms functionality of SAP NetWeaver Knowledge Management. An authenticated user could cause an unauthorized XSL transformation to be processed, potentially resulting in arbitrary code execution in the application context. SAP, acting as CNA, scored the issue CVSS v3.1 9.9. The vector combines network reachability and low privileges with high confidentiality, integrity, and availability impact, so it matters for any organization running the listed KMC-CM 7.50 component.

This post summarizes what the public record establishes about CVE-2026-109803, and is just as explicit about what the record leaves open. The aim is to support accurate prioritization without filling gaps with assumptions.

Technical information

Root cause

The XML Forms functionality does not sufficiently restrict which XSL transformations it selects and processes. Under certain conditions, an authenticated user with access to that functionality can cause an unauthorized XSL transformation to be processed. SAP states that this could lead to arbitrary code execution in the application context. Successful exploitation could affect the confidentiality, integrity, and availability of the application.

The weakness is classified as CWE-94, Improper Control of Generation of Code (Code Injection). MITRE frames this category around externally influenced input that modifies the syntax or behavior of an intended code segment. That classification supports calling the issue code injection. The mechanism documented for this CVE is narrower, though. It is the selection and processing of an XSL transformation that should not have been permitted.

CVSS vector

SAP published the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• Attack vector: Network
• Attack complexity: Low
• Privileges required: Low. Authentication is required, but high privileges are not.
• User interaction: None. The score assumes no additional user interaction.
• Scope: Changed. The impact crosses a security authority boundary.
• Confidentiality, integrity, and availability: High for each.

The FIRST CVSS v3.1 specification clarifies two of these values. A changed scope concerns a different security authority, and on its own it is not evidence of root or operating system administrator access. A base score expresses the intrinsic severity of a vulnerability. It does not show that exploitation has occurred.

The score shown on NVD comes from SAP as the CNA. NVD notes that its own assessment has not yet been provided.

Attack flow

Based on SAP's description, the supported exploitation sequence is:

1. The attacker authenticates to the SAP NetWeaver system.
2. The attacker obtains access to the affected XML Forms functionality.
3. The attacker causes an unauthorized XSL transformation to be selected, which is possible because the functionality does not sufficiently restrict that selection.
4. Under the conditions SAP describes, the transformation is processed, potentially resulting in arbitrary code execution in the application context.

The CNA record states code execution as a possible consequence. It does not present it as a publicly demonstrated outcome.

What is not publicly established

The public records we reviewed do not identify any of the following:

• the vulnerable endpoint
• the request parameters
• the required SAP authorization objects
• the exact enabling conditions
• the transformation selection syntax
• the affected transformation processor implementation

They also contain no exploit payload or reproduction procedure. The low complexity score does not make the phrase "under certain conditions" any less significant. The evidence does not show whether exploitation needs a separately uploaded stylesheet, a particular extension mechanism, or a later privilege escalation step.

On the evidence, this is a critical authenticated application exposure. Neither a verified exploit recipe nor a full host compromise has been shown.

Exploitation status

The CNA record contains no exploitation status. We found no validated public proof of concept and no attribution to any threat actor.

We reviewed CISA KEV catalog version 2026.11.09, released November 9, 2026. It has no entry for CVE-2026-109803, but that snapshot predates the November 10 publication, so it cannot settle the CVE's status after disclosure.

Affected systems and versions

• Vendor: SAP SE (recorded as SAP_SE)
• Product: SAP NetWeaver Knowledge Management (XML Forms)
• Affected version entry: KMC-CM 7.50
• Vulnerable configuration: the attacker needs authenticated access to the affected XML Forms functionality, and SAP notes exploitation depends on "certain conditions" that are not publicly detailed.

Use the KMC-CM 7.50 entry to assess applicability rather than assuming every NetWeaver installation is affected.

SAP references Security Note 3809153 and its Security Patch Day resources for this issue. The note's public route presents a sign-in page, so fixed package levels and prerequisites could not be confirmed from public material. Retrieve the note through SAP for Me, where SAP lists security corrections under All Security Notes.

To identify relevant notes and find systems outside security maintenance because of outdated support package levels, SAP recommends SAP Cloud ALM Configuration & Security Analysis or SAP Maintenance Planner.

Vendor security history

SAP is headquartered in Walldorf, Germany, and was founded on April 1, 1972. Its software spans finance, procurement, human resources, supply chain, and customer experience.

SAP holds a regular Security Patch Day on the second Tuesday of each month. Its Product Security Response Team investigates reported vulnerabilities, coordinates with reporters and development teams, and informs customers through Security Notes and associated patches.

Two earlier cases are relevant here.

CVE-2021-37531, XML Forms XSLT injection. This older CVE record also names SAP NetWeaver Knowledge Management XML Forms. It describes an authenticated attacker who crafts a malicious XSL stylesheet containing operating system commands and then triggers XSLT execution. Onapsis reported the issue to SAP on June 28, 2021, and SAP released Security Note 3081888 on September 14, 2021.

A second transformation-related issue in the same functionality is worth noting in the vendor's history. Still, the sources do not establish that CVE-2026-109803 is a regression, an incomplete earlier fix, or the same underlying defect. The operating system command execution described for the 2021 issue should not be assumed for the new one.

CVE-2025-31324, NetWeaver Visual Composer. Unit 42 documented exploitation of this separate component beginning in mid-March 2025. The flaw was a missing authorization check that allowed unauthenticated arbitrary file uploads. Observed activity included JSP webshell deployment, subsequent command execution, reverse shell tools, and a reverse SSH SOCKS proxy.

This case shows real attacker interest in NetWeaver systems. Its entry point, tooling, and indicators, however, are not established for CVE-2026-109803.

The three cases compare as follows:

The closest technical resemblance is the 2021 XML Forms case. The strongest evidence of real attacks comes from the 2025 Visual Composer case. Neither is a sound basis for inferring the new vulnerability's internals or assigning it a threat actor.

References

• NVD: CVE-2026-109803
• CVE Record API: CVE-2026-109803
• SAP Security Note 3809153 (SAP for Me sign in required)
• SAP Security Notes & News, Security Patch Day
• CWE-94: Improper Control of Generation of Code
• FIRST CVSS v3.1 Specification Document
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON Feed
• SAP Security Optimization Services
• SAP Vulnerability Disclosure Policy
• SAP Company Information
• SAP Corporate Fact Sheet
• What is SAP?
• CVE Record: CVE-2021-37531
• Onapsis: SAP Enterprise Portal XSLT injection advisory
• Unit 42 Threat Brief: CVE-2025-31324
• Cyber Security Agency of Singapore: Critical Vulnerabilities in SAP NetWeaver