SAP fixes code injection in NetWeaver Knowledge Management

The latest supplied update is Xbow's claim that SAP Security Note 3809153 addresses CVE-2026-109803, a critical code-injection vulnerability in NetWeaver Knowledge Management's XML Forms component. Xbow assigns it a CVSS score of 9.9 and says an authenticated user could potentially execute code by triggering an unauthorized XSL transformation.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list

According to Xbow, the reported flaw is associated with SAP Note 3809153 and affects the XML Forms component of NetWeaver Knowledge Management. The supplied evidence includes a link to that SAP note, but no note text that independently confirms the technical description or the fix.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list

The issue matters because the reported outcome is potential code execution, not merely unauthorized access to information. The claimed CVSS score of 9.9 places it near the top of the severity scale, although the supplied material does not detail the privileges, system configuration, or user interaction needed beyond authentication.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

Administrators running NetWeaver Knowledge Management should review SAP Security Note 3809153, determine whether XML Forms is present and affected, and follow SAP's documented remediation instructions. Exact affected releases and installation steps cannot be derived from this evidence batch.[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

Known from the supplied posts: Xbow associates the issue with CVE-2026-109803, Note 3809153, XML Forms, authenticated access, unauthorized XSL transformation, potential code execution, and CVSS 9.9. Unknown here are the affected versions, fixed package levels, exploitation status, indicators of compromise, proof-of-concept availability, and whether additional prerequisites limit the attack path.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list

Xbow described the SAP patch release as massive and said its collaboration with Onapsis contributed to finding 14 vulnerabilities covered by seven SAP Security Notes, including this claimed CVSS 9.9 code-injection issue.[3]Xbowx.com · Xbow · xOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

The supplied sequence begins with Xbow's broad overview of the SAP Security Patch Day. One second later, Xbow posted the first detailed thread entry, identifying Note 3809153, CVE-2026-109803, the affected XML Forms component, and the claimed execution path.[3]Xbowx.com · Xbow · xOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

2 independent groups, 1 updates, and 4 engagements.

The claimed path starts with an authenticated user interacting with NetWeaver Knowledge Management's XML Forms component. Xbow says the user can trigger an unauthorized XSL transformation, with potential code execution as the resulting impact. No payload, vulnerable function, or execution context is provided in the batch.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

The batch contains a primary link to SAP Security Note 3809153, but its title and body are absent. All substantive claims about the CVE, severity, affected component, attack conditions, impact, and broader patch release therefore come from two Xbow posts and remain unverified by the note text supplied here.[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list[3]Xbowx.com · Xbow · xOpen original sourceSee in source list