{"api_version":"1","generated_at":"2026-11-12T18:58:21+00:00","cve":"CVE-2026-109802","urls":{"html":"https://cve.report/CVE-2026-109802","api":"https://cve.report/api/cve/CVE-2026-109802.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-109802","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-109802"},"summary":{"title":"Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP","description":"SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.","state":"PUBLISHED","assigner":"sap","published_at":"2026-11-10 01:17:14","updated_at":"2026-11-10 22:11:23"},"problem_types":["CWE-369","CWE-369 CWE-369: Divide By Zero"],"metrics":[{"version":"3.1","source":"cna@sap.com","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://me.sap.com/notes/3793716","name":"https://me.sap.com/notes/3793716","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://url.sap/sapsecuritypatchday","name":"https://url.sap/sapsecuritypatchday","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109802","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109802","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected KRNL64NUC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 7.22EXT","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected KRNL64UC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 7.53","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 8.04","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected KERNEL 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 7.54","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 7.77","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 7.93","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 9.16","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 9.18","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 9.20","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver Application Server for ABAP","version":"affected 9.21","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"109802","cve":"CVE-2026-109802","epss":"0.003070000","percentile":"0.236950000","score_date":"2026-11-10","updated_at":"2026-11-11 00:08:16"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-109802","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:34:04.714937Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T20:34:51.977Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver Application Server for ABAP","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"8.04"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.</p>"}],"value":"SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-369","description":"CWE-369: Divide By Zero","lang":"eng","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T00:38:26.482Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"url":"https://me.sap.com/notes/3793716"},{"url":"https://url.sap/sapsecuritypatchday"}],"source":{"discovery":"UNKNOWN"},"title":"Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2026-109802","datePublished":"2026-11-10T00:38:26.482Z","dateReserved":"2026-10-13T03:49:31.799Z","dateUpdated":"2026-11-10T20:34:51.977Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 01:17:14","lastModifiedDate":"2026-11-10 22:11:23","problem_types":["CWE-369","CWE-369 CWE-369: Divide By Zero"],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-10T20:34:04.714937Z","id":"CVE-2026-109802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"109802","Ordinal":"1","Title":"Denial of Service (DoS) vulnerability in SAP NetWeaver Applicati","CVE":"CVE-2026-109802","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"109802","Ordinal":"1","NoteData":"SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user could send specially crafted requests to trigger an error in internal processing. This could crash the affected work process and make the system unavailable. This results in a high impact on availability with no impact on confidentiality and integrity.","Type":"Description","Title":"Denial of Service (DoS) vulnerability in SAP NetWeaver Applicati"}]}}}