CVE-2026-109811: Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated attacker with low privileges. The attacker must also trick a victim into interacting with a malicious server.
Are default deployments affected?
The vulnerability is attributed to insecure default settings in an internal ABAP HTTP component, so environments using those defaults are affected.
What is the likely impact of successful exploitation?
An attacker may access sensitive information belonging to the victim and modify limited non-sensitive information. The issue has high confidentiality impact, low integrity impact, and no availability impact.