CVE-2026-109804

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109804", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-10-13T03:49:31.799Z", "datePublished": "2026-11-10T00:38:58.561Z", "dateUpdated": "2026-11-10T20:31:13.675Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-11-10T00:38:58.561Z"}, "title": "Information Disclosure in SAP NetWeaver (SAP Message Server)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver (SAP Message Server)", "versions": [{"status": "affected", "version": "KRNL64UC 7.53"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.20"}, {"status": "affected", "version": "9.21"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3808552"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T20:27:47.394974Z", "id": "CVE-2026-109804", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:31:13.675Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109804", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-10-13T03:49:31.799Z", "datePublished": "2026-11-10T00:38:58.561Z", "dateUpdated": "2026-11-10T20:31:13.675Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-11-10T00:38:58.561Z"}, "title": "Information Disclosure in SAP NetWeaver (SAP Message Server)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver (SAP Message Server)", "versions": [{"status": "affected", "version": "KRNL64UC 7.53"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.20"}, {"status": "affected", "version": "9.21"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3808552"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T20:27:47.394974Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:31:07.727Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver (SAP Message Server)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "KRNL64UC 7.53"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.20"}, {"status": "affected", "version": "9.21"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability."}], "id": "CVE-2026-109804", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109804", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T20:27:47.394974Z", "version": "2.0.3"}}]}, "published": "2026-11-10T01:17:14.610", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3808552"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{}