CVE-2026-109801
Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)
Description
SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system users. Successful exploitation results in a high impact on confidentiality, with no impact on integrity or availability of the application.
INFO
Published Date :
Nov. 10, 2026, 12:38 a.m.
Last Modified :
Nov. 10, 2026, 12:38 a.m.
Remotely Exploit :
Yes !
Source :
sap
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | e4686d1a-f260-4930-ac4c-2f5c992778dd |
Solution
- Apply the latest security patches for SAP NW AS Java.
- Review and enforce authorization rules for user access.
- Restrict access to sensitive information retrieval functions.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-109801 vulnerability anywhere in the article.