CVE-2026-109809

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109810

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-109801

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-109810 CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

EUVD-2026-120692

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-109810

The SAP NetWeaver Application Server Java (Web Dynpro Java) component is vulnerable to a CSS injection flaw due to insufficient validation of request parameters used to resolve styling resources. An unauthenticated attacker can craft a malicious link that, when opened by an authenticated victim, ...

EUVD-2026-120691

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109809

The SAP NetWeaver Application Server Java (NWDI Cockpit) is vulnerable to a security flaw where it fails to perform sufficient authorization checks before processing certain requests. This Missing Authorization (CWE-862) allows an attacker with low privileges to perform unauthorized modifications...

CVE-2026-109809 Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109801 Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

EUVD-2026-120684

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

CVE-2026-109801

SAP NetWeaver Application Server Java (NWDI Cockpit) is vulnerable to an authorization bypass (CWE-639) because it fails to perform sufficient permission checks when retrieving certain information. A low-privileged attacker can exploit this by sending a specially crafted request to access sensiti...

CVE-2026-109809: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

CVE-2026-109801: SAP_SE SAP NetWeaver Application Server Java (NWDI Cockpit): SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain…

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

PT-2026-141256

SAP NetWeaver Application Server Java NWDI Cockpit does not perform sufficient authorization checks for certain functionality before processing the requests. An attacker with low privileges could exploit this to perform unauthorized modifications. Successful exploitation results in high impact on...

PT-2026-141248

SAP NetWeaver Application Server Java NWDI Cockpit� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive information belonging to other system...

PT-2026-141257

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-109810: SAP_SE SAP NetWeaver Application Server Java (Web Dynpro Java): SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used…

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-58235: Dependency on Vulnerable Third-Party Component

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

SAP NetWeaver Application Server Java 7.5 - Local File Inclusion Detection

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...