Medium 6.5

SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization...

CVE-2026-109809 First seen on SecPulse Nov 10, 09:40

Original description The description as published by the source.

SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 09:40
GHSA: GHSA-gcgg-v79q-5cmx
CWE: CWE-862

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Java

CWE

CWE-862

All

Sap Se Sap Netweaver Application Server Java Nwdi Cockpit

Detection sources

NIST National Vulnerability Database07:11
GitHub Security Advisories (Global)Nov 10, 12:30
CVE.org (CVE Program・cvelistV5)04:53