CVE-2026-109803

Summary

SAP NetWeaver Knowledge Management (XML Forms) allows authenticated users to trigger unauthorized XSL transformations due to insufficient input validation, potentially leading to arbitrary code execution in the application context. This is a server-side code injection vulnerability (CWE-94) that can compromise confidentiality, integrity, and availability.

Exploitability

Exploitation requires authenticated access with privileges to use the affected XML Forms functionality; no public exploit exists, but the low attack complexity suggests feasible exploitation by skilled attackers.

Blast radius

Successful exploitation could allow an attacker to fully compromise the SAP application server, exfiltrate sensitive enterprise data, modify system behavior, or disrupt business operations across integrated SAP modules.

Detection

Monitor SAP application logs for unusual XSLT processing events, especially those involving external entity references or dynamic stylesheet loading from user-controlled input; look for anomalies in HTTP request parameters containing XSLT syntax (e.g., <xsl:stylesheet>, <xsl:eval>, or java: class invocations) in Knowledge Management module requests.

Prioritized remediation

Apply SAP Security Note 3214567 (or later) to patch the XSL transformation restriction flaw; if unavailable, restrict access to the XML Forms processing endpoint to privileged users only and disable non-essential XSL functionality until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.