CVE-2026-109805: Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP)
Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Systems are exposed where an authenticated attacker already has high privileges and can access a network segment carrying communication between application servers in the SAP system. The issue is specifically tied to RFC callbacks between application servers.
What does an attacker need to exploit this issue?
The attacker needs valid authentication, high privileges, and network-position access sufficient to intercept inter-application-server traffic. No user interaction is required.
What could an attacker do after successful exploitation?
An attacker could alter the caller identity in an RFC callback and make unauthorized function calls on the target server with escalated privileges. This can affect the confidentiality, integrity, and availability of the application.