Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-109803 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | SAP |
| Product | NetWeaver Knowledge Management |
| Vulnerability Type | code execution (unauthorized XSL transformation) (CWE-94) |
| SAP Note | 3809153 |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, SAP
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.
The flaw was published as part of the November 2026 SAP Security Patch Day. The attack requires an account with low privileges.
Required Actions
- Apply the fix from SAP Note 3809153 (SAP Security Patch Day, November 2026).
- Determine whether Knowledge Management with XML Forms is used in your SAP NetWeaver portal (AS Java) and limit access to this functionality to users who actually need it.
- Until patched, monitor unusual activity of accounts with access to XML Forms.
Who Is Affected?
This vulnerability affects SAP NetWeaver Knowledge Management. NVD provides no CPE configuration; affected versions and support packages are listed in SAP Note 3809153 (requires an SAP for Me account). SAP systems are mainly used by mid-sized and large enterprises (ERP, S/4HANA, NetWeaver platforms), so also check systems operated by partners and service providers.
The same Patch Day covered eight other critical SAP flaws: CVE-2026-109795, CVE-2026-109798, CVE-2026-120017, CVE-2026-76964, CVE-2026-76965, CVE-2026-89103, CVE-2026-89119, CVE-2026-89126.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-109803 vulnerability?
CVE-2026-109803 is a vulnerability in SAP NetWeaver Knowledge Management — code execution (unauthorized XSL transformation) — rated CVSS 9.9 (critical severity). SAP released a fix in Note 3809153 as part of the November 2026 SAP Security Patch Day.
Does exploiting CVE-2026-109803 require authentication?
According to the vendor's CVSS assessment, the attack requires an account with low privileges. The attack is carried out over the network.
How to protect against CVE-2026-109803?
Apply the fix from SAP Note 3809153 and, until it is deployed, restrict network access to the affected component. The note lists affected versions and any available workarounds.
Who is affected by CVE-2026-109803?
It affects organizations running SAP NetWeaver Knowledge Management, typically mid-sized and large enterprises with SAP ERP or S/4HANA and the related NetWeaver components.
