AS ABAP HTTP Client SSRF: CVE-2026-109811 · CVSS 3.0 6.5 · SAP Note 3805959
Note 3805959 fixes a server-side request forgery in an internal HTTP component of AS ABAP. The root cause lies in insecure default settings. An authenticated user with low privileges could get a victim to interact with an attacker’s server. As a result, the victim’s sensitive information could leak. SAP rates the AS ABAP HTTP Client SSRF at CVSS 6.5, Medium. In this post, we cover exposure, the fix and what to check.
AS ABAP HTTP Client SSRF: affected releases
This issue affects a wide range of releases: SAP_BASIS 700 to 702, 731, 740, 750 to 816 and 920 to 921. The fix adds an allowlist check. From then on, the HTTP client only sends requests to permitted destinations.
What to do
Apply the correction instructions or the support package. However, the fix introduces an allowlist, so test outbound HTTP integrations afterwards. That way, you make sure that legitimate destinations still work after this fix. FAQ: 3834382.
Why the allowlist matters
SSRF bugs turn the application server into a proxy for the attacker. For example, the server can reach internal hosts or cloud metadata services that the attacker cannot. Therefore, the AS ABAP HTTP Client SSRF allowlist is useful beyond this single CVE.
What to check
First, list your outbound HTTP destinations in SM59 and in custom code. Next, add the required hosts to the allowlist before you transport the fix to production. Finally, review ICM traces for outbound calls to unexpected hosts, because they can reveal earlier use of the AS ABAP HTTP Client SSRF.
AS ABAP HTTP Client SSRF: advisory details
Component: BC-MID-ICF
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 9
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Source: SAP Security Note 3805959 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
