Vulnerability record/PUBLISHED/Published Nov 10, 2026 00:40:36 UTC

CVE-2026-109809

SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on integrity, with no impact on confidentiality and availability of the application.

Base score6.5/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredLowPR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactNoneC

Integrity impactHighI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritysap

Last updatedNov 10, 2026 19:53:16 UTC

PublishedNov 10, 2026 00:40:36 UTC

ReservedOct 13, 2026 03:49:31 UTC