CVE-2026-89110

CriticalCVSS 9.9/10Last modified Oct 15, 2026

Description

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-8911110.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the ten CVE-2026-891126.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the targe CVE-2026-891138.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authentica CVE-2026-891165.9The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to CVE-2026-891176.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-891185.3SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application info CVE-2026-89127.5The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.CVE-2026-891207.1A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be CVE-2026-891214.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business objec CVE-2026-891226.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft CVE-2026-891244.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionali CVE-2026-89138.5A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-con