CRITICALCVSS v3.1 9.9Vulnerability
CVE-2026-109803
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. Successful exploitation could impact the confidentiality, integrity, and availability of the application.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.00409
- Cvss severity
- CRITICAL
- Cvss score
- 9.9
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Last source
- FIRST EPSS
- Score
- 9.9
- Cvss version
- 3.1
- Cve id
- CVE-2026-109803
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- First seen by Signal
- 2026-11-10T03:20:44+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Published at
- 2026-11-10T01:17:14.477
- Last modified
- 2026-11-10T22:11:23.807
- Epss percentile
- 0.3552
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph