CVE-2026-89103

CriticalCVSS 10.0/10Last modified Nov 11, 2026

Description

SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	SAP Gateway	KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; 8.04; KERNEL 7.22; 7.54; 7.77; 7.93; 9.16; 9.20; 9.21

References

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-891054.2The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSU CVE-2026-891064.4SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially cr CVE-2026-891079.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that util CVE-2026-891089.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative function CVE-2026-89116.1The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to CVE-2026-891109.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privile CVE-2026-8911110.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the ten CVE-2026-891126.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the targe CVE-2026-891138.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authentica CVE-2026-891147.5SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker CVE-2026-891154.4SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with h CVE-2026-891165.9The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to