Knowledge Management XSLT Code Injection: CVE-2026-109803 · CVSS 3.0 9.9 · SAP Note 3809153
XML Forms in SAP NetWeaver Knowledge Management render content through XSL transformations. Note 3809153 fixes a preview function that let the request choose the transformation. However, it did not check that choice against the project’s configuration. As a result, an authenticated user with access to XML Forms could point it at their own stylesheet. That leads to code execution in the portal’s application context. SAP rates the Knowledge Management XSLT Code Injection at CVSS 9.9, HotNews. In this post, we cover exposure, the fix and what to check.
Knowledge Management XSLT Code Injection: affected release
The note covers KMC-CM 7.50 on SAP NetWeaver AS Java (Enterprise Portal). The fix limits request-selected transformations to those configured for the current XML Forms project. In contrast, the fix rejects everything else. Projects with properly configured display transformations should therefore keep working after the Knowledge Management XSLT Code Injection fix.
Correction and workaround
Deploy the support package patch from the note. Until then, limit this risk and restrict XML Forms functionality to trusted users. In addition, review permissions on XML Forms project resources in KM. Portals that allow self-registration should move fastest. The same applies to portals with a large authenticated user population.
What to check
First, list who holds KM content administrator or XML Forms Builder access. Next, check KM repositories for unexpected XSL files, a possible trace of the Knowledge Management XSLT Code Injection. After patching, open a sample of XML Forms projects and confirm that their display transformations still render.
Why the score is so high
Code execution in the portal context gives an attacker the portal’s own service users and destinations. Consequently, the Knowledge Management XSLT Code Injection can reach backend systems connected to the portal. That explains the changed scope and the 9.9 score, even though the attacker needs a valid user.
Knowledge Management XSLT Code Injection: advisory details
Component: EP-KM-CM
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3809153 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
