Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SAP_SE | SAP NetWeaver and ABAP Platform (Application Server ABAP) | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 10 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application. | |
| Title | Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP) | |
| Weaknesses | CWE-328 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: sap
Published:
Updated: 2026-11-10T00:49:24.750Z
Reserved: 2026-10-13T03:49:31.799Z
Link: CVE-2026-109805
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T01:17:14.777
Modified: 2026-11-10T01:17:14.777
Link: CVE-2026-109805
Redhat
No data.
OpenCVE Enrichment
No data.