CVE-2026-109795

Summary

SAP NetWeaver lacks proper authorization checks and input validation in remote-enabled functionality, allowing low-privileged attackers to inject and execute arbitrary code via crafted remote requests. This enables full system compromise including data theft, modification, and service disruption.

Exploitability

Exploitation requires only low privileges and network access to the affected remote interface; no user interaction is needed.

Blast radius

Successful exploitation grants attackers broad lateral movement and full control over the SAP system and potentially connected systems, severely compromising confidentiality, integrity, and availability across the enterprise landscape.

Detection

Look for anomalous RFC or HTTP requests with unexpected parameter structures or SQL-like syntax in SAP gateway logs (icftrace, dev_rfc, or icm logs), especially from low-privilege users; also monitor for unusual child process creation or execution of non-standard ABAP routines via system audit logs.

Prioritized remediation

Apply SAP Security Note 3192845 or upgrade to SAP NetWeaver 7.50 Support Package Stack 12 (SPS 12) or later; until then, disable all non-essential remote-enabled functionality and restrict access to affected endpoints via network segmentation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.