CVE-2026-109804: Information Disclosure in SAP NetWeaver (SAP Message Server)
SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker who can reach the SAP Message Server over the network could exploit it. No user interaction or prior privileges are required.
What does an attacker need to send?
Exploitation requires specially crafted malformed requests directed at the SAP Message Server. The issue is described as having low attack complexity.
What is the expected impact of successful exploitation?
Successful exploitation may disclose sensitive information. The provided assessment indicates high confidentiality impact, with no integrity or availability impact.