Brief Summary: SAP Message Server CVE-2026-109804 Unauthenticated Information Disclosure (CWE 908)

Introduction

SAP Message Server sits at the center of communication within an SAP system network, so a flaw that lets an unauthenticated party pull sensitive data out of it is relevant to any team operating SAP NetWeaver. SAP disclosed that kind of issue on its November 2026 Security Patch Day. The Message Server mishandles certain malformed requests, and the flaw is rated 7.5 (High) under CVSS v3.1 with a high confidentiality impact.

This post is a brief summary of what the public record says about CVE-2026-109804, what it leaves out, and how to establish whether your landscape is in scope. The vendor field in the supplied CVE data reads "Unknown", but the affected vendor is SAP SE and the affected product is SAP NetWeaver, specifically SAP Message Server.

Technical information

Root cause class: CWE 908, Use of Uninitialized Resource

SAP's description is short: the Message Server "does not properly handle certain malformed requests", which an unauthenticated attacker can use to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information. Integrity and availability are explicitly not affected.

The weakness is classified as CWE 908, Use of Uninitialized Resource. MITRE defines this as using or accessing a resource that has not been initialized. The typical confidentiality consequence MITRE describes is reuse of memory or a variable without clearing its previous contents before that data is sent to an untrusted party. Read together with SAP's description, the plausible shape of the bug is a request handling path where a malformed input causes the server to return a response built from a resource that was never properly initialized for that request.

We want to be careful about how far that inference goes. The SAP disclosure does not identify the precise resource, the source code path, the port or protocol exchange involved, the request opcode, or what data ends up in the response. Nothing in the public material establishes a specific memory layout, an arbitrary memory read primitive, or credential disclosure. CWE 908 explains the class of defect. It does not tell us what an attacker receives.

What the CVSS vector says

SAP supplied the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Broken down:

Attack Vector: Network (AV:N), reachable remotely.
Attack Complexity: Low (AC:L), no special conditions disclosed.
Privileges Required: None (PR:N), no authentication.
User Interaction: None (UI:N).
Scope: Unchanged (S:U).
Confidentiality: High (C:H).
Integrity: None (I:N) and Availability: None (A:N).

These are base metrics describing the vulnerability itself. They say nothing about the network exposure of a given installation, and they are not evidence of exploitation. FIRST keeps exploit maturity in the separate Temporal metric group. The record also makes no claim of remote code execution, data modification, or denial of service.

Attack flow as disclosed

Based solely on the public description, the sequence looks like this:

The attacker has network reachability to an affected SAP Message Server instance. No credentials are needed.
The attacker sends a malformed request containing specially crafted input.
The Message Server fails to handle the malformed request properly. Given the CWE 908 classification, this likely involves an uninitialized resource being used while processing or answering the request.
The attacker retrieves sensitive information from the server's response.

The specifics of steps 2 through 4 (which interface, which message format, which bytes, which data) are not public. The available description does not support building a reliable exploit test, and we have not attempted to construct one.

Disclosure status

The NVD record was published at 2026-11-10T01:17:14.610 with an identical last modified timestamp and a status of Received. That reflects publication and processing, not the discovery date, the start of any exploitation, or a completed independent NVD assessment.

Affected systems and versions

The NVD API and CVE record list eight affected version labels. We preserve the record's wording rather than adding component prefixes to the abbreviated entries:

KRNL64UC 7.53
KERNEL 7.53
7.54
7.77
7.93
9.16
9.20
9.21

These labels say where the flaw applies. None of them is a corrected release, and 9.21 is on the list too, so it should not be treated as a fixed target. The record does not name a fixed build or patch level, and it does not enumerate every downstream SAP application that embeds an affected Message Server.

In practice, establishing applicability means checking the actual component and release in your landscape against these labels, then pulling SAP Note 3808552 through SAP for Me. The note's public page presents a sign-in screen, so its correction instructions, prerequisites, fixed builds and any workaround were not visible to us. SAP's general guidance is that security fixes for NetWeaver-based products ship via support packages, but no specific support package for this CVE is public.

SAP also documents Message Server hardening parameters independently of this CVE. They are general measures, and none of them is a confirmed workaround for CVE-2026-109804:

ms/acl_file_admin, ms/acl_file_ext, ms/acl_file_extbnd and ms/acl_file_int control which client IP addresses can create connections.
ms/acl_info restricts which hosts, domains, addresses or subnetworks can log on as application servers.
Setting ms/admin_port to 0 closes previously opened administration ports and prevents other external clients from logging on for administration.

Because the vulnerable interface is not publicly specified, restricting administration access does not establish that every Message Server request path is covered. SAP also notes that dynamically changed parameter values are lost on Message Server restart, after which profile or default values apply again, so persist any changes in profiles. The parameter reference we used identifies itself as version 2025 FPS00.

Vendor security history

SAP releases corrections as Security Notes on Security Patch Day, the second Tuesday of each month. November 10, 2026 is on its published calendar. SAP also runs separate reporting channels for customers and researchers, asking for affected versions, support package and patch levels, exploitation preconditions and impact.

The most relevant recent precedent is CVE-2025-31324, an unauthenticated file upload vulnerability in the SAP NetWeaver Visual Composer development server. Canada's Cyber Centre reports exploitation dating from March 2025 and an SAP emergency update on April 24, 2025. CISA added it to the Known Exploited Vulnerabilities catalog on April 29, 2025 based on evidence of active exploitation. SAP then addressed CVE-2025-42999 on May 13, 2025, a patch the Canadian advisory says removed residual risk left after the CVE-2025-31324 fix. Protera, describing its own response, scanned managed environments for vulnerable Visual Composer instances and applied emergency Note 3594142 where feasible.

That episode shows that an initial correction and later guidance can both matter, but it involved a different component, a different attack path and a different fix. It does not imply the same outcome here.

For CVE-2026-109804 itself, we found no confirmed exploitation, no named threat actor, no public proof of concept, no ransomware linkage and no published indicators of compromise. The CISA KEV feed we retrieved (version 2026.11.09, released 2026-11-09T19:54:37Z) predates this CVE's NVD publication, so it cannot answer the KEV question either way. These are gaps in the evidence, not evidence of absence. The defensible position is to apply the SAP note on its merits and reassess as new reporting appears.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information