CVE-2026-109804

high

Description

SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.

References

https://url.sap/sapsecuritypatchday

https://me.sap.com/notes/3808552

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120687

Details

Source: Mitre, NVD

Published: 2026-11-10

Updated: 2026-11-10

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

EPSS

EPSS: 0.00328