Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109802

Authenticated divide-by-zero DoS in SAP NetWeaver AS ABAP

CVSS 3.1
6.5 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-109802 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Application Server for ABAP does not properly validate certain input values (CWE-369). An authenticated user can send crafted network requests that trigger an internal processing error, crash the affected work process, and make the system unavailable. Confidentiality and integrity are not affected. Deployments of this ABAP application server are affected; SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-109802. No workaround is named.

ProductAffected
SAP NetWeaver Application Server for ABAP—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.

Weakness
CWE-369
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story