{"affected":[{"defaultStatus":"unaffected","product":"S4CRM","source":"CNA: sap","vendor":"SAP_SE","versions":[{"status":"affected","version":"S4CRM 204"},{"status":"affected","version":"205"},{"status":"affected","version":"206"},{"status":"affected","version":"S4CEXT 107"},{"status":"affected","version":"108"},{"status":"affected","version":"109"},{"status":"affected","version":"BBPCRM 713"},{"status":"affected","version":"714"}]}],"cveId":"CVE-2026-109795","cwes":["CWE-94"],"description":"SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.9,"severity":"critical","source":"CNA: sap","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794271021453,"publishedAt":1794271021453,"references":[{"source":"CNA: sap","tags":[],"url":"https://me.sap.com/notes/3834842"},{"source":"CNA: sap","tags":[],"url":"https://url.sap/sapsecuritypatchday"}],"remediation":[],"revision":"156d6ac7cddd6fa6547c5e9ff4053501302fe789d91625923f3ce9f3b86f73cb","sources":[{"modifiedAt":1794271021453,"name":"CNA: sap","retrievedAt":1794272907805,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109795"}],"ssvc":null,"status":"published","title":"Missing authorization check in S4CRM","updatedAt":1794272907805}