Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SAP_SE | SAP NetWeaver and ABAP Platform (Application Server ABAP) | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 10 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitive information belonging to the victim and modify limited non-sensitive information. This results in a high impact on confidentiality and low impact on integrity. Availability is not impacted. | |
| Title | Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: sap
Published:
Updated: 2026-11-10T00:41:08.379Z
Reserved: 2026-10-13T03:49:31.800Z
Link: CVE-2026-109811
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T01:17:15.607
Modified: 2026-11-10T01:17:15.607
Link: CVE-2026-109811
Redhat
No data.
OpenCVE Enrichment
No data.