CVE-2026-109800: Memory Corruption vulnerability in SAP Web Dispatcher
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated to SAP Web Dispatcher as a non-administrative user. No user interaction is required.
What is the operational impact if exploitation succeeds?
The attacker can cause the SAP Web Dispatcher process to terminate. This makes the dispatcher and all backend systems reachable through it unavailable; confidentiality and integrity are not affected.
What conditions indicate that an environment is exposed?
An environment is exposed if it uses SAP Web Dispatcher and non-administrative authenticated users can submit the affected processed inputs. The available information does not identify a default configuration or specific affected versions.