Medium 6.5

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has...

CVE-2026-109811 First seen on SecPulse Nov 10, 09:41

Original description The description as published by the source.

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 09:41
GHSA: GHSA-89rq-v3p4-r9vp
CWE: CWE-918

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Server-Side Request Forgery

CWE

CWE-918

All

Sap Se Sap Netweaver And Abap Platform Application Server Abap

Detection sources

NIST National Vulnerability Database07:11
GitHub Security Advisories (Global)Nov 10, 12:30
CVE.org (CVE Program・cvelistV5)04:52