Cryptographic issues in SAP NetWeaver AS ABAP - CVE-2026-109805
Published: November 11, 2026
Vulnerability identifier: #VU164914
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109805
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform MitM attack.
The vulnerability exists due to weak cryptography. A remote privileged user with access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges.
Affected software
SAP NetWeaver AS ABAP
How to mitigate CVE-2026-109805
Install updates from vendor's website.