SAP Note 3803832: Web Dispatcher Memory Corruption (CVE-2026-109800)

Web Dispatcher Memory Corruption: CVE-2026-109800 · CVSS 3.0 7.7 · SAP Note 3803832

Note 3803832 fixes insufficient input validation in SAP Web Dispatcher that can lead to memory corruption. A user authenticated as a non-administrative user can send crafted input that terminates the Web Dispatcher process. As a result, every backend reachable only through it becomes unavailable. For that reason, the CVSS scope changes, and SAP rates the Web Dispatcher Memory Corruption at CVSS 7.7, High. In this post, we cover exposure, the fix and what to check.

Web Dispatcher Memory Corruption: who is affected

This issue only affects Web Dispatchers in front of AS ABAP or AS Java whose profile contains MSHOST or MSSHOST. In contrast, Web Dispatchers in front of HANA or third-party systems are not on the list, and neither is the one in HANA XS. Therefore, check each Web Dispatcher profile for those parameters.

Fix

SAP lists releases 7.53, 7.54, 7.77, 7.93 and 9.16 for the Web Dispatcher, and kernel up to 9.21. Patch with SAPWEBDISP.SAR for standalone installations or with the kernel for embedded ones. Unfortunately, there is no workaround for this issue.

Plan one rollout

This month brings several Web Dispatcher fixes, including Notes 3778556, 3804858, 3808627, 3805681 and 3782056. So plan one rollout that covers all of them, including this fix. That way, you restart each Web Dispatcher only once.

What to check

First, list every Web Dispatcher and note which backends it serves. Then check which profiles contain MSHOST or MSSHOST. Finally, confirm the patch level after the update, because a single forgotten instance keeps this risk open for its backends.

Web Dispatcher Memory Corruption: advisory details

Component: BC-CST-WDP
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Source: SAP Security Note 3803832 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.