Vulnerability record/PUBLISHED/Published Nov 10, 2026 00:41:08 UTC

CVE-2026-109811

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.

Base score6.5/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityHighAC

Privileges requiredLowPR

User interactionRequiredUI

ScopeChangedS

Confidentiality impactHighC

Integrity impactLowI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritysap

Last updatedNov 10, 2026 19:52:01 UTC

PublishedNov 10, 2026 00:41:08 UTC

ReservedOct 13, 2026 03:49:31 UTC