CVE-2026-109796: Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-level privileges on the affected SAP NetWeaver Application Server ABAP or ABAP Platform system. The provided information does not indicate that unauthenticated attackers can exploit it.
What is the potential impact if exploitation succeeds?
Successful exploitation may disclose uninitialized memory contents, resulting in a low confidentiality impact. The issue has no stated impact on integrity or availability.
What exploit conditions are known?
The disclosure occurs only under certain unspecified conditions in internal components. No further details on affected configurations, versions, or compensating controls are provided.