ABAP RFC Divide-by-Zero DoS: CVE-2026-109802 · CVSS 3.0 6.5 · SAP Note 3793716
Note 3793716 fixes missing validation of certain input values in RFC processing on AS ABAP. An authenticated user can send requests that cause a divide by zero inside the kernel. As a result, the work process crashes. Moreover, repeated requests make the system unavailable. SAP rates this issue at CVSS 6.5, Medium. In this post, we cover exposure, the fix and what to check.
ABAP RFC Divide-by-Zero DoS: fix
The ABAP RFC Divide-by-Zero DoS affects kernel 7.22 (including EXT), 7.53, 7.54, 7.77, 7.93, 8.04 and 9.16 to 9.21. SAP delivers the fix through dw.sar or the SP Stack Kernel. In addition, FAQ note 3794042 answers common questions.
What to do
The fix comes with the same kernel update as the other November RFC and Gateway notes. So no separate action is necessary beyond that update. Still, confirm that every application server picks up the new kernel, because one old instance keeps this issue open.
Who can exploit it
Any user with RFC access can send the crafted request. In practice, that includes many technical and interface users. Therefore, this issue is a good reason to review which accounts really need RFC logon rights.
What to check
First, look for repeated short dumps or work process restarts in SM21 and ST22. Next, review S_RFC authorizations for interface users. Finally, after the kernel update, check that this fix is active on all instances, for example in SM51.
ABAP RFC Divide-by-Zero DoS: advisory details
Component: BC-MID-RFC
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3793716 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
