Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109796

Uninitialized memory disclosure in SAP NetWeaver ABAP

CVSS 3.1
4.3 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-109796 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Application Server ABAP and ABAP Platform fail to initialize memory in certain internal components. A low-privileged attacker on the network can, under specific conditions, read uninitialized memory without user interaction. The leak has a low effect on confidentiality and none on integrity or availability. Affected version ranges are not stated.

What to do: Apply SAP's update for CVE-2026-109796. No fixed version or workaround is stated.

ProductAffected
SAP NetWeaver Application Server ABAP—
SAP ABAP Platform—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

Weakness
CWE-908
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories