CVE-2026-109803: SAP NetWeaver Knowledge Management XSL Transformation RCE — Detection and Remediation Guide

---
title: SAP NetWeaver Suspicious Child Process Execution
id: 8f3a1b42-7c9d-4e5f-a123-4b6c8d9e0f12
status: experimental
description: Detects suspicious child processes spawned by SAP NetWeaver Java application server processes, potentially indicating exploitation of CVE-2026-109803 or similar RCE vulnerabilities.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109803
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\\jlaunch.exe'
      - '\\jstart.exe'
      - '\\sapstartsrv.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\rundll32.exe'
      - '\\mshta.exe'
      - '\\certutil.exe'
      - '\\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate SAP administrative scripts executed by administrators
  - SAP monitoring tools
level: high
---
title: SAP NetWeaver Suspicious XSL File Access
id: 2b4d6f81-9a3c-4e7b-b456-7c9d0e1f2a34
status: experimental
description: Detects file creation or modification of XSL files in SAP NetWeaver temporary or upload directories, which may indicate malicious XSL transformation upload attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109803
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\usr\\sap\\'
      - '\\temp\\'
      - '\\tmp\\'
      - '\\upload\\'
    TargetFilename|endswith:
      - '.xsl'
      - '.xslt'
  filter_legitimate_paths:
    TargetFilename|contains:
      - '\\sapmnt\\'
      - '\\trans\\'
  condition: selection and not filter_legitimate_paths
falsepositives:
  - Legitimate SAP customization or development activity
  - SAP transport imports
level: medium
---
title: SAP Portal Suspicious HTTP POST to XML Forms Endpoint
id: 5c7e9a12-3d6f-4b8c-c789-0e2f3a4b5c67
status: experimental
description: Detects HTTP POST requests to SAP NetWeaver Knowledge Management XML Forms endpoints from external or unusual source IPs, potentially indicating exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109803
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path|contains:
      - '/irj/servlet/prt/portal/prtroot/'
      - '/irj/go/km/'
      - 'xmlforms'
      - 'xml_form'
  filter_internal:
    c-ip|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate external partner access to SAP portal
  - Load balancer health checks
level: high

// Hunt for SAP NetWeaver Java processes spawning suspicious child processes
// Relevant for CVE-2026-109803 exploitation detection
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("jlaunch.exe", "jstart.exe", "sapstartsrv.exe")
| where FileName has_any ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by TimeGenerated desc

// Correlate with network connections to external IPs from SAP processes
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("jlaunch.exe", "jstart.exe", "javaw.exe")
| where RemoteIPType == "Public"
| where RemotePort in (80, 443, 8080, 8443)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc

-- Hunt for suspicious child processes spawned by SAP NetWeaver Java processes
-- Targeting CVE-2026-109803 exploitation indicators
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Ppid,
    ParentName
FROM pslist()
WHERE 
    (ParentName =~ '(?i)jlaunch|jstart|sapstartsrv')
    AND (Name =~ '(?i)cmd|powershell|wscript|cscript|rundll32|mshta|certutil|bitsadmin')

-- Hunt for recently created or modified XSL files in SAP directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(
    globs=['C:/usr/sap/**/temp/**/*.xsl', 'C:/usr/sap/**/temp/**/*.xslt', 'C:/usr/sap/**/upload/**/*.xsl', 'C:/usr/sap/**/upload/**/*.xslt']
)
WHERE Mtime > now() - (7 * 24 * 60 * 60)
ORDER BY Mtime DESC

-- Check for network connections from SAP processes to external IPs
SELECT 
    Pid,
    Name,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    Status
FROM netstat()
WHERE 
    Name =~ '(?i)jlaunch|jstart|javaw'
    AND RemoteAddr !~ '^(10\\.|172\\.16\\.|192\\.168\\.|127\\.)'
    AND RemotePort IN (80, 443, 8080, 8443)

# CVE-2026-109803 - SAP NetWeaver KM XML Forms Vulnerability Detection and Remediation Script
# Run on SAP application servers or from a management workstation with access to SAP systems

Write-Host "=== CVE-2026-109803 Detection and Remediation Script ===" -ForegroundColor Cyan
Write-Host ""

# Function to check for SAP NetWeaver installation
function Check-SAPInstallation {
    Write-Host "[*] Checking for SAP NetWeaver installation..." -ForegroundColor Yellow
    
    $sapPaths = @(
        "C:\usr\sap",
        "D:\usr\sap",
        "/usr/sap"
    )
    
    $sapFound = $false
    foreach ($path in $sapPaths) {
        if (Test-Path $path) {
            Write-Host "[+] SAP installation found at: $path" -ForegroundColor Green
            $sapFound = $true
            
            # Enumerate SAP instances
            $instances = Get-ChildItem -Path $path -Directory -ErrorAction SilentlyContinue
            foreach ($instance in $instances) {
                Write-Host "    - Instance: $($instance.Name)" -ForegroundColor Cyan
            }
        }
    }
    
    if (-not $sapFound) {
        Write-Host "[-] No SAP installation detected on this system" -ForegroundColor Red
        return $false
    }
    return $true
}

# Function to check for suspicious processes
function Check-SuspiciousProcesses {
    Write-Host ""
    Write-Host "[*] Checking for suspicious child processes from SAP services..." -ForegroundColor Yellow
    
    $sapProcesses = Get-Process | Where-Object { $_.Name -match 'jlaunch|jstart|sapstartsrv|javaw' }
    
    if ($sapProcesses) {
        Write-Host "[+] Found $($sapProcesses.Count) SAP-related processes" -ForegroundColor Green
        
        foreach ($proc in $sapProcesses) {
            Write-Host "    - PID: $($proc.Id) | Name: $($proc.Name) | Path: $($proc.Path)" -ForegroundColor Cyan
            
            # Check child processes
            $childProcs = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $proc.Id }
            foreach ($child in $childProcs) {
                $suspicious = $child.Name -match 'cmd|powershell|wscript|cscript|rundll32|mshta|certutil|bitsadmin'
                if ($suspicious) {
                    Write-Host "      [!] SUSPICIOUS CHILD PROCESS: $($child.Name) (PID: $($child.ProcessId))" -ForegroundColor Red
                    Write-Host "          CommandLine: $($child.CommandLine)" -ForegroundColor Red
                }
            }
        }
    } else {
        Write-Host "[-] No SAP processes currently running" -ForegroundColor Yellow
    }
}

# Function to check for recently modified XSL files
function Check-XSLFiles {
    Write-Host ""
    Write-Host "[*] Checking for recently modified XSL files in SAP directories..." -ForegroundColor Yellow
    
    $searchPaths = @("C:\usr\sap", "D:\usr\sap")
    $cutoffDate = (Get-Date).AddDays(-7)
    
    foreach ($path in $searchPaths) {
        if (Test-Path $path) {
            $xslFiles = Get-ChildItem -Path $path -Recurse -Include *.xsl,*.xslt -ErrorAction SilentlyContinue | 
                        Where-Object { $_.LastWriteTime -gt $cutoffDate }
            
            if ($xslFiles) {
                Write-Host "[!] Found $($xslFiles.Count) recently modified XSL files:" -ForegroundColor Red
                foreach ($file in $xslFiles) {
                    Write-Host "    - $($file.FullName)" -ForegroundColor Red
                    Write-Host "      Modified: $($file.LastWriteTime)" -ForegroundColor Yellow
                }
            } else {
                Write-Host "[+] No recently modified XSL files found in $path" -ForegroundColor Green
            }
        }
    }
}

# Function to check SAP version and patch level
function Check-SAPVersion {
    Write-Host ""
    Write-Host "[*] Checking SAP NetWeaver version information..." -ForegroundColor Yellow
    Write-Host "[!] MANUAL ACTION REQUIRED:" -ForegroundColor Red
    Write-Host "    1. Log in to SAP NetWeaver Administrator (NWA)" -ForegroundColor Yellow
    Write-Host "    2. Navigate to: System Information -> Components" -ForegroundColor Yellow
    Write-Host "    3. Check the version of 'KM-KW' (Knowledge Management) component" -ForegroundColor Yellow
    Write-Host "    4. Compare against SAP Security Note for CVE-2026-109803" -ForegroundColor Yellow
    Write-Host ""
    Write-Host "    Official SAP Security Patch: https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html" -ForegroundColor Cyan
}

# Function to provide remediation guidance
function Show-RemediationSteps {
    Write-Host ""
    Write-Host "=== REMEDIATION STEPS ===" -ForegroundColor Cyan
    Write-Host ""
    Write-Host "1. APPLY SAP SECURITY PATCH IMMEDIATELY" -ForegroundColor Green
    Write-Host "   - Download the security patch for CVE-2026-109803 from SAP Support Portal" -ForegroundColor White
    Write-Host "   - Follow SAP Note instructions for applying the patch to NetWeaver KM" -ForegroundColor White
    Write-Host ""
    Write-Host "2. RESTRICT ACCESS TO XML FORMS FUNCTIONALITY" -ForegroundColor Green
    Write-Host "   - Review and restrict user roles with access to XML Forms" -ForegroundColor White
    Write-Host "   - Disable XML Forms if not required for business operations" -ForegroundColor White
    Write-Host "   - Implement network segmentation to limit access to SAP portal" -ForegroundColor White
    Write-Host ""
    Write-Host "3. MONITOR FOR EXPLOITATION ATTEMPTS" -ForegroundColor Green
    Write-Host "   - Deploy the Sigma rules provided in this advisory" -ForegroundColor White
    Write-Host "   - Review SAP application logs for suspicious XML Forms activity" -ForegroundColor White
    Write-Host "   - Monitor for unexpected child processes from SAP Java processes" -ForegroundColor White
    Write-Host ""
    Write-Host "4. INCIDENT RESPONSE" -ForegroundColor Green
    Write-Host "   - If suspicious activity is detected, isolate affected SAP servers" -ForegroundColor White
    Write-Host "   - Collect forensic images and logs before remediation" -ForegroundColor White
    Write-Host "   - Engage your incident response team" -ForegroundColor White
    Write-Host ""
}

# Main execution
try {
    $sapInstalled = Check-SAPInstallation
    
    if ($sapInstalled) {
        Check-SuspiciousProcesses
        Check-XSLFiles
        Check-SAPVersion
        Show-RemediationSteps
        
        Write-Host ""
        Write-Host "[+] Script execution completed. Review findings above." -ForegroundColor Green
    } else {
        Write-Host ""
        Write-Host "[-] This system does not appear to have SAP NetWeaver installed." -ForegroundColor Yellow
    }
} catch {
    Write-Host "[!] Error during execution: $_" -ForegroundColor Red
}