Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109800

Authenticated memory-corruption DoS in SAP Web Dispatcher

CVSS 3.1
7.7 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-109800 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP Web Dispatcher does not sufficiently validate certain inputs, which can corrupt memory. A non-administrative user who is already authenticated can send crafted input over the network, with no user interaction, and terminate the Web Dispatcher process. The dispatcher and every backend system reached through it then become unavailable. Confidentiality and integrity are not affected.

What to do: Apply SAP's update for CVE-2026-109800. SAP has not listed a fixed version or workaround.

ProductAffected
SAP Web Dispatcher—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application.

Weakness
CWE-121
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories