CVE-2026-109803: Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)
SAP_SE · SAP NetWeaver Knowledge Management (XML Forms)
No fix listed · Affected: SAP_SE SAP NetWeaver Knowledge Management (XML Forms) · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 35% of scored CVEs
DescriptionNVD
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- SAP fixes 38 flaws, including nine critical vulnerabilitiesSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.