Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109803

Authenticated code injection via XSL in SAP NetWeaver KM

CVSS 3.1
9.9 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-109803 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict which XSL transformations the affected function processes. An authenticated user who already has access to that function can, under certain conditions, cause an unauthorized XSL transformation to run, which may execute arbitrary code in the application context. That can affect confidentiality, integrity, and availability of the application.

What to do: Apply SAP's update for CVE-2026-109803. SAP has not listed a fixed version or workaround.

ProductAffected
SAP NetWeaver Knowledge Management (XML Forms)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.

Weakness
CWE-94
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

3 stories