CVE-2026-109800 PUBLISHED

Memory Corruption vulnerability in SAP Web Dispatcher

Assigner: sap
Reserved: 13.10.2026 Published: 10.11.2026 Updated: 10.11.2026

SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the Web Dispatcher process to terminate without user interaction. As a result, the Web Dispatcher and all backend systems reachable through it become unavailable, leading to a high impact on availability. There is no impact on confidentiality or integrity of the application.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS Score: 7.7

Product Status

Vendor SAP_SE
Product SAP Web Dispatcher
Versions Default: unaffected
  • Version KRNL64UC 7.53 is affected
  • Version WEBDISP 7.53 is affected
  • Version 7.54 is affected
  • Version 7.77 is affected
  • Version 7.93 is affected
  • Version 9.16 is affected
  • Version KERNEL 7.53 is affected
  • Version 9.20 is affected
  • Version 9.21 is affected

References

Problem Types