RFC Callback Weak HMAC: CVE-2026-109805 · CVSS 3.0 6.4 · SAP Note 3786876
Note 3786876 hardens the HMAC that protects RFC callbacks between application servers of the same AS ABAP system. With the weaker calculation, a privileged attacker on the network segment between servers could intercept traffic. Then the attacker could change the caller’s identity and run function calls with someone else’s privileges. SAP rates the RFC Callback Weak HMAC at CVSS 6.4, Medium, mainly because of the adjacent network requirement. In this post, we cover exposure, the fix and what to check.
RFC Callback Weak HMAC: fix
This issue affects kernel 7.22 (including EXT), 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.21. Deploy the fix through dw.sar or the SP Stack Kernel. In addition, it comes with the same kernel update as the other November RFC notes.
Context
Few landscapes encrypt traffic between application servers, and the server network is often flat. Consequently, an attacker with a foothold there can see and change internal RFC traffic. Enabling SNC for internal communication reduces this whole class of risk, not just this issue.
Who can exploit it
The attacker needs high privileges and a position on the server network. For that reason, the RFC Callback Weak HMAC is not a first-step attack. However, it fits well into a later stage, after an attacker has compromised one host in the data centre.
What to check
First, confirm which kernel each application server runs after the update. Next, review whether SNC protects internal RFC traffic in your landscape. Finally, check network segmentation between SAP servers and other systems, since a flat network makes the RFC Callback Weak HMAC much easier to reach.
RFC Callback Weak HMAC: advisory details
Component: BC-MID-RFC
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: SAP Security Note 3786876 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
