MEDIUMCVSS v3.1 6.4Vulnerability
CVE-2026-109805
Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.00132
- Cvss score
- 6.4
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Score
- 6.4
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-109805
- Cvss vector
- CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-10T03:20:44+00:00
- Vector
- CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-11-10T01:17:14.777
- Last modified
- 2026-11-10T20:17:38.127
- Epss percentile
- 0.02792
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph