SAP NetWeaver Knowledge Management (XML Forms) code injection may allow arbitrary code execution (CVE-2026-109803)

What happened

SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict which XSL transformations can be selected and processed by the affected functionality. An attacker who is already authenticated and has access to the feature can cause an unauthorised XSL transformation to be processed. Under certain conditions this can lead to arbitrary code execution in the application context, with a direct impact on confidentiality, integrity and availability. The issue is classed as CWE-94, code injection.

The CVSS 3.1 rating is 9.9, critical. It is reachable over the network, needs only a low-privilege authenticated user and no user interaction, and has changed scope. That means the exploit can move from the immediate component to the wider application environment, not only the vulnerable function.

The CVE record does not state that the flaw has been publicly disclosed or exploited.

Who is affected

SAP NetWeaver Knowledge Management (XML Forms), version KMC-CM 7.50, is the listed affected product. No other affected versions are listed in the CVE record. The exposure is most relevant where the XML Forms capability is available to authenticated users. Organisations should confirm whether the component exists in their estate and review which roles can reach it.

What to do now

1. Confirm whether KMC-CM 7.50 and the XML Forms component are present, and identify which users or roles can reach it.
2. Restrict access to the affected functionality to the smallest set of trusted users, and remove it from any externally reachable application where possible.
3. No fixed release or vendor workaround is listed yet. Monitor the SAP Security Patch Day page and SAP's advisory note referenced with this page, and apply vendor guidance when it appears.
4. Review authorisations and access to the affected feature while the exposure remains open.

Beyond the patch

Because the flaw is reachable over the network but requires an authenticated session, access review is the immediate control. The code execution that can follow is post-exploitation activity that Managed Detection & Response (MDR) watches for. Implementation & Assessment Services can test and harden the XML Forms exposure, and SAP HANA Security & Cloud Migration can review the surrounding SAP authorisation model so fewer roles can reach the component.