Sources: National Vulnerability Database, CVE.org, CISA KEV, FIRST EPSS
CVE-2026-120014 Overview
SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability.
Critical Impact
Affected Products
- SAP HANA XSA Web Dispatcher: see the vendor advisory for the exact affected versions
Discovery Timeline
- 2026-11-10: CVE-2026-120014 published to the National Vulnerability Database by cna@sap.com
- 2026-11-10: last updated in the NVD database
Technical Details for CVE-2026-120014
Vulnerability Analysis
CVE-2026-120014 is a Cross Site Request Forgery weakness (CWE-352: Cross Site Request Forgery) in SAP HANA XSA Web Dispatcher. Based on its CVSS vector, the flaw can be reached over the network, needs no login, and relies on a user taking an action. A logged in user's browser can be tricked into sending unwanted requests.
With a CVSS base score of 7.6, apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Root Cause
The weakness is classified as CWE-352: Cross Site Request Forgery. A logged in user's browser can be tricked into sending unwanted requests.
Attack Vector
Based on the CVSS vector, the flaw can be reached over the network, needs no login, and relies on a user taking an action. Attack complexity is low complexity.
No exploitation in the wild is confirmed by CISA at the time of the last update. Check the references below for any vendor or researcher proof of concept.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Detection Methods for CVE-2026-120014
Detection Strategies
- Inventory every instance of SAP HANA XSA Web Dispatcher and compare the running version with the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Run an authenticated vulnerability scan once your scanner ships a check for this CVE.
Monitoring Recommendations
- Forward SAP HANA XSA Web Dispatcher application, access and audit logs to your SIEM for retrospective hunting.
- Alert on new processes, configuration changes or outbound connections from the affected service.
- Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.
How to Mitigate CVE-2026-120014
Immediate Actions Required
- Apply the fixed version of SAP HANA XSA Web Dispatcher named in the vendor advisory.
- Prioritize internet facing and business critical instances first.
- Rescan after the change to confirm the exposure is closed.
Patch Information
Use the fixed version listed in the vendor advisory for SAP HANA XSA Web Dispatcher.
Workarounds
- If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.
CWE References
- CWE-352: Cross Site Request Forgery More CVEs with this weakness
Technical References
This entry is built directly from NVD, CISA KEV and EPSS data. Verify fixed versions in the vendor advisory before you deploy.
Frequently asked questions
Related CVEs
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.
Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-120014 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications