Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109804

Unauthenticated information disclosure in SAP Message Server

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-109804 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP Message Server mishandles certain malformed requests (uninitialized resource). An unauthenticated remote attacker can send specially crafted input and retrieve sensitive information. Confidentiality is highly affected; integrity and availability are not. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-109804. No workaround is stated.

ProductAffected
SAP Message Server—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.

Weakness
CWE-908
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories