SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-109797
Cross-tenant sandbox access in SAP Astonish Incus backend
- CVSS 3.1
- 7.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Authenticated users of SAP Astonish can identify and act on another team's sandbox containers because legacy Incus sandbox-management API handlers skip the tenant-aware session lookup. Over the network, a low-privileged user can list, expose or proxy, and delete those containers, causing limited disclosure and high availability impact. Only the legacy Incus backend is affected; Kubernetes and OpenShell deployments are not.
What to do: Apply SAP's update for CVE-2026-109797. The flaw is limited to the legacy Incus backend; Kubernetes and OpenShell deployments do not expose the affected handlers.
| Product | Affected |
|---|---|
| SAP Astonish | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.
- Weakness
- CWE-1220
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H