Advisory · CVE-2026-109803
SAP NetWeaver Knowledge Management XSL flaw can lead to arbitrary code execution
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict which XSL transformations are processed, letting an authenticated user trigger an unauthorized transformation and potentially execute arbitrary code. SAP rates it CVSS 3.1 9.9.
- Vendor
- SAP
- Product
- NetWeaver Knowledge Management
- Identifier / CWE
- CVE-2026-109803
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Knowledge Management lets a signed-in user pick a transformation template without checking it properly, and a malicious template can run code inside the application.
- 01Authenticated access
An attacker with an account reaches the Knowledge Management XML Forms functionality.
- 02Unauthorized transformation selected
The attacker causes an unauthorized XSL transformation to be selected for processing.
- 03Transformation processed
The application processes the transformation without sufficient restriction.
- 04Code executes
The transformation leads to arbitrary code execution in the application context.
What happened
SAP disclosed CVE-2026-109803 for SAP NetWeaver Knowledge Management (XML Forms) KMC-CM 7.50. The functionality does not sufficiently restrict the selection of XSL transformations (CWE-94), so under certain conditions an authenticated user with access to it can cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context. SAP says successful exploitation could impact the confidentiality, integrity, and availability of the application. SAP scores it 9.9.
Apply SAP note 3809153 through the normal SAP patch process; this advisory does not name a fixed version beyond the note.
What to do
- Inventory every NetWeaver Knowledge Management deployment, including test, training, and individually managed instances.
- Apply the vendor fix exactly as directed in the linked SAP security note.
- Restrict network access to NetWeaver Knowledge Management while remediation is underway, especially for internet-facing instances.
- Review application and server logs for XML Forms transformation requests from ordinary users and unexpected process execution.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
An ordinary signed-in user is enough to reach this, so the exposure is every account with XML Forms access. Patch, and review who has used the functionality.