CVE-2026-109795: Missing authorization check in S4CRM
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access and must be able to submit specially crafted input through an affected remote interface. No user interaction is required.
Which deployments should be prioritized for investigation?
Prioritize SAP NetWeaver environments that expose or use the affected remote-enabled functionality, especially where low-privileged accounts can access those interfaces. The supplied information does not identify affected versions or specific interface names.
Is a workaround or patch applicability information provided?
No workaround, fixed version, or configuration mitigation is included in the supplied information. The referenced SAP note is the available source for vendor remediation details.