SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-109794
Unauthenticated resource exhaustion in SAP NetWeaver and Web Dispatcher
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not limit resource use when handling certain requests (CWE-835). An unauthenticated remote attacker can send specially crafted requests that drive excessive resource consumption and disrupt the service. Availability is the only impact; confidentiality and integrity are unaffected. Affected versions and fixed builds are not stated.
What to do: Apply SAP's update for CVE-2026-109794. No workaround is named.
| Product | Affected |
|---|---|
| SAP NetWeaver Application Server ABAP | — |
| SAP ABAP Platform | — |
| SAP Web Dispatcher | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing excessive resource utilization and service disruption. This results in a high impact on availability. There is no impact on confidentiality and integrity.
- Weakness
- CWE-835
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H