# CVE-2026-109811: SAP NetWeaver SSRF in ABAP HTTP component

Source: https://junglewise.ai/threats/cve-2026-109811-an-internal-abap-http-component-in-sap-netweaver-and-abap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-109811 · Severity: medium · CVSS 6.5 · Published 2026-11-10

An internal HTTP component in SAP NetWeaver and ABAP Platform has a server-side request forgery (SSRF) vulnerability caused by insecure default settings. An authenticated attacker could trick a victim into interacting with a malicious server to access sensitive business information or make limited unauthorized modifications. This vulnerability requires user interaction and existing authentication but poses a significant risk to data confidentiality.

Technologies: [SAP ABAP Platform](https://junglewise.ai/threats/technologies/sap-abap-platform), [SAP NetWeaver](https://junglewise.ai/threats/technologies/netweaver). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-109811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109811 being exploited in the wild.

**How severe is CVE-2026-109811?** Medium severity, with a CVSS score of 6.5, published 10 November 2026.

**Which products and versions are affected?** SAP NetWeaver; SAP ABAP Platform.

**Is there a fix for CVE-2026-109811?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109811 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109811?** Check whether you run SAP ABAP Platform or SAP NetWeaver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SSRF vulnerability exists in an internal ABAP HTTP component within SAP NetWeaver's Application Server ABAP and ABAP Platform due to insecure defaults. An authenticated, low-privilege attacker can exploit this via social engineering or malicious server interaction to access sensitive information and modify non-sensitive data. A fix is available via SAP Security Note 3805959 published on the November 2026 patch day.

## Affected products

- SAP NetWeaver
- SAP ABAP Platform

## Timeline

- 2026-11-10: disclosed

## References

- [https://me.sap.com/notes/3805959](https://me.sap.com/notes/3805959)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76973-due-to-a-memory-corruption-vulnerability-in-application-server)
- [SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76970-due-to-a-memory-corruption-vulnerability-in-application-server)
- [SAP NetWeaver ABAP RFC protocol memory corruption](https://junglewise.ai/threats/cve-2026-76966-due-to-improper-rfc-protocol-validation-in-the-sap-kernel-used-by)
- [SAP NetWeaver Application Server ABAP authorization bypass](https://junglewise.ai/threats/cve-2026-76965-sap-netweaver-application-server-abap-and-abap-platform-does-not)
- [SAP NetWeaver AS ABAP authentication assertion verification bypass](https://junglewise.ai/threats/cve-2026-120017-sap-netweaver-as-abap-and-abap-platform-does-not-perform)