External risk intelligence

SAP NetWeaver XML Forms XSL Transformation Processing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-109803

The vulnerability exists within SAP NetWeaver Knowledge Management, which is a component of an enterprise application platform. While these systems are often network-accessible, the specific XML Forms functionality typically resides behind organizational access controls and requires user authentication, making internet-wide exposure possible but not the default design for this specific feature.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in SAP NetWeaver Knowledge Management's XML Forms, allowing authenticated users to potentially execute arbitrary code. This could impact the confidentiality, integrity, and availability of the application.

Unrestricted transformations may allow code execution.
It impacts core enterprise application platforms.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by gaining authenticated access to SAP NetWeaver Knowledge Management. From there, they could manipulate the XML Forms functionality to process a malicious XSL transformation. This could lead to unauthorized code execution within the application.

Requires authenticated user access.
Triggers by processing a malicious XSL transformation.
Risks code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with access to SAP NetWeaver Knowledge Management's XML Forms could potentially process unauthorized XSL transformations. This may lead to arbitrary code execution within the application's context, impacting the confidentiality, integrity, and availability of the application.

System data within the application context.
Processing unauthorized XSL transformations.
Application confidentiality, integrity, and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

SAP NetWeaver Knowledge Management (XML Forms) owners are responsible for this critical vulnerability. Initial triage should focus on identifying instances of the affected functionality, assessing its reachability and business criticality, and confirming the accountable owner. Planning remediation based on the identified risk is the subsequent step.

Application and platform owners should lead.
Verify XML Forms exposure and business impact.
Plan remediation with SAP and infrastructure teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SAP NetWeaver Knowledge Management?

SAP NetWeaver Knowledge Management is a platform component designed for storing, organizing, and accessing unstructured information within an enterprise. It provides tools for content creation and document management, including XML Forms, which are used to define structured input templates for capturing and displaying data across the organization's business processes.

What is the vulnerability in CVE-2026-109803?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). It occurs because the XML Forms component fails to properly validate or restrict XSL transformations before processing them. An attacker can abuse this by providing a crafted transformation, effectively instructing the application to execute unauthorized commands or code within its own runtime environment.

How is this vulnerability triggered?

The issue is triggered when an authenticated user supplies a malicious XSL transformation to the XML Forms functionality. The process does not require high-level administrative rights, but it does require existing access to the specific form-processing feature. It is not triggered by public or unauthenticated web requests, as the initial login context is a necessary prerequisite.

Why does Halo Surface Signal categorize this as a concern?

Halo Surface Signal notes that while SAP NetWeaver Knowledge Management is part of a larger enterprise platform, it can be network-accessible. Because the vulnerability requires an authenticated user, it is not immediately available to the entire internet, but it remains a significant risk for any instance where the XML Forms functionality is accessible to users within or connected to your network.

Do I need to take immediate action for this CVE?

Yes, you should prioritize identifying where XML Forms is active in your environment. Start by mapping which systems run this specific component and determine who is responsible for managing them. Consult the official SAP security patch resources to understand the available updates and prepare a deployment plan to mitigate the potential for unauthorized code execution.

References

me.sap.com/notes/3809153

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.