CVE-2026-109807: Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can send requests to the affected SAP NetWeaver Internet Graphics Service can attempt exploitation. No privileges or user interaction are required.
What is the practical impact of successful exploitation?
A specially crafted request can cause the affected worker process to terminate repeatedly. The described impact is denial of service and reduced availability; no confidentiality or integrity impact is stated.
What input condition triggers the failure?
The issue involves insufficient validation of certain input values in incoming requests, allowing the process to read beyond declared values. The provided information does not identify the specific request parameters or endpoints involved.