Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-109807

Unauthenticated DoS in SAP NetWeaver Internet Graphics Service

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-109807 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Internet Graphics Service does not sufficiently validate certain input values in incoming requests. An unauthenticated remote attacker can send a crafted request that makes the process read beyond declared values and repeatedly terminate the worker process. Impact is limited to availability; integrity and confidentiality are unaffected. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-109807. SAP has not listed a fixed version or workaround.

ProductAffected
SAP NetWeaver (Internet Graphics Service)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.

Weakness
CWE-190
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories