CVE-2026-109795
SAP NetWeaver S4CRM missing authorization check enables remote code execution (CVE-2026-109795)
SAP NetWeaver components S4CRM 204, 205, 206; S4CEXT 107, 108, 109; and BBPCRM 713, 714 have a missing authorization check in remote-enabled functionality. A low-privileged attacker can inject and execute arbitrary code, CVSS 9.9. No fixed release is listed; restrict access and monitor.
What happened
CVE-2026-109795 is a code injection flaw (CWE-94) caused by a missing authorization check and insufficient input validation in certain remote-enabled functionality of SAP NetWeaver used by S4CRM, S4CEXT and BBPCRM. An attacker with low privileges can send specially crafted input through a remote interface and execute arbitrary code within the affected system.
Execution is rated critical with a CVSS 3.1 base score of 9.9. The attack works over the network with low complexity, requires low privileges and no user interaction, and changes scope; successful exploitation can extend the attacker's reach beyond the vulnerable component, with high impact on confidentiality, integrity and availability.
The CVE record does not report active exploitation or public disclosure.
Who is affected
The affected releases are S4CRM 204, 205 and 206; S4CEXT 107, 108 and 109; and BBPCRM 713 and 714. These are SAP NetWeaver components named in the CVE record. No fixed versions are listed in the CVE record.
What to do now
- Confirm whether your SAP landscape runs S4CRM 204, 205 or 206; S4CEXT 107, 108 or 109; or BBPCRM 713 or 714.
- Treat affected systems as exposed: the CVE record lists no fixed release or workaround for this flaw.
- Restrict access to the affected remote-enabled functionality. Allow only trusted users and networks, and review low-privileged accounts that can reach the interface.
- Monitor remote-enabled activity and SAP security audit logs for unexpected calls or signs of code execution while no fixed release is available.
- Check the SAP security note and Security Patch Day page linked in the references for a fixed release, and apply SAP's guidance once it is published.
How to detect it
SAP has not published specific indicators for this flaw. Until a fixed release is available, monitor SAP security audit logs and remote-enabled interface activity for unusual function calls, unexpected changes to accounts or privileges, and signs of arbitrary code execution on affected hosts.
Beyond the patch
An authorization boundary that can be crossed from a low-privileged position makes reducing exposure and catching follow-on activity the immediate tasks. Our SAP HANA Security & Cloud Migration practice reviews SAP estates for missing authorization controls and exposed remote interfaces. If code execution occurs, Managed Detection & Response (MDR) watches for execution and account abuse. Regular Implementation & Assessment Services testing can find injection and missing authorisation gaps before an incident.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| S4CRM | S4CRM 204 205 206 S4CEXT 107 108 109 BBPCRM 713 714 | No fixed version listed yet |