{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109804", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-10-13T03:49:31.799Z", "datePublished": "2026-11-10T00:38:58.561Z", "dateUpdated": "2026-11-10T00:38:58.561Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-11-10T00:38:58.561Z"}, "title": "Information Disclosure in SAP NetWeaver (SAP Message Server)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver (SAP Message Server)", "versions": [{"status": "affected", "version": "KRNL64UC 7.53"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.20"}, {"status": "affected", "version": "9.21"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3808552"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver (SAP Message Server)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "KRNL64UC 7.53"}, {"status": "affected", "version": "KERNEL 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.20"}, {"status": "affected", "version": "9.21"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability."}], "id": "CVE-2026-109804", "lastModified": "2026-11-10T01:17:14.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cna@sap.com", "type": "Primary"}]}, "published": "2026-11-10T01:17:14.610", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3808552"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "cna@sap.com", "type": "Primary"}]}

{}

{}