NWDI Cockpit Access Control: CVE-2026-109801 · CVE-2026-109809 · CVSS 3.0 6.5 · SAP Note 3839977
Note 3839977 fixes two authorization problems in NWDI Cockpit on SAP NetWeaver AS Java. First, CVE-2026-109801 lets a low-privileged user retrieve sensitive information that belongs to other users (an IDOR). Second, CVE-2026-109809 lets the same kind of user make unauthorised modifications. Both score CVSS 6.5, Medium. In this post, we cover the NWDI Cockpit Access Control issue: exposure, the fix and what to check.
NWDI Cockpit Access Control: fix
The fix targets DI_NTY 7.50. Specifically, SAP adds object-level and server-side authorization checks. Deploy the support package patch, and check SAP Note 1974464 for SCA dependencies before you start. In addition, plan a short test of the cockpit with a normal developer account afterwards.
Why integrity matters here
NWDI holds source code and transport tracks for Java development. Therefore, unauthorised changes there can end up in production builds. In landscapes that still build Java through NWDI, this issue matters more than the score suggests.
Who can exploit it
The attacker needs a valid low-privileged account on the NWDI system. In practice, many developers and external partners hold such accounts. So the NWDI Cockpit Access Control bugs give a wide group of people a path to other teams’ data and tracks.
What to check
First, review who has access to NWDI and remove accounts of people who left projects. Next, compare recent changes in development tracks with the expected activity. Finally, after patching, confirm that users can only see their own objects, which closes the NWDI Cockpit Access Control gap.
NWDI Cockpit Access Control: advisory details
Component: BC-CTS-DI
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: SAP Security Note 3839977 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
