Message Server Information Disclosure: CVE-2026-109804 · CVSS 3.0 7.5 · SAP Note 3808552
Note 3808552 fixes a memory disclosure in the SAP Message Server. When a call on the external port failed, the server returned uninitialised memory. Consequently, an unauthenticated attacker could send malformed requests to collect that memory. What leaks depends on what was in the buffer. That is why SAP rates the confidentiality impact of the Message Server Information Disclosure as high: CVSS 7.5. In this post, we cover exposure, the fix and what to check.
Message Server Information Disclosure: affected kernels
This issue affects kernel 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.21. The fix initialises the memory and improves error handling. SAP delivers it via dw.sar or SAPEXE.SAR, and SAP Notes 2083594 and 19466 describe the steps.
Why it matters
Memory leaks from a pre-authentication service are often the first step towards a reliable memory corruption exploit. After all, they reveal addresses and internal state. Moreover, SAP fixes two other Message Server memory bugs this month. Therefore, treat this issue together with them.
What to do
Patch the kernel, because there is no workaround for the Message Server Information Disclosure. In addition, restrict the external Message Server port to hosts that genuinely need it. Usually, that means only the application servers of the same system.
What to check
First, scan which networks can reach the external Message Server port. Then compare the result with your list of application servers and monitoring hosts. Finally, confirm the new kernel patch level on every instance after the update. These checks close the Message Server Information Disclosure and limit future bugs of the same kind.
Message Server Information Disclosure: advisory details
Component: BC-CST-MS
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: SAP Security Note 3808552 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
