CVE-2026-109801: Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)
SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system users. Successful exploitation results in a high impact on confidentiality, with no impact on integrity or availability of the application.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access to SAP NetWeaver Application Server Java (NWDI Cockpit). Exploitation does not require user interaction and can be performed remotely by sending a specially crafted request.
What is the expected impact if exploitation succeeds?
An attacker could retrieve sensitive information belonging to other system users. The stated impact is limited to confidentiality; integrity and availability are not affected.