CVE-2026-89119

CriticalCVSS 9.6/10Last modified Nov 11, 2026

Description

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	SAP Web Dispatcher and Internet Communication Manager	WEBDISP 7.93; 9.16; XS_ADVANCED_RUNTIME 1.00; KERNEL 7.93; 9.20; 9.21

References

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-89127.5The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.CVE-2026-891207.1A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be CVE-2026-891214.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business objec CVE-2026-891226.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft CVE-2026-891244.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionali CVE-2026-891256.0Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative p CVE-2026-8912610.0SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker coul CVE-2026-891285.3Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP w CVE-2026-891295.8Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a CVE-2026-89138.5A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v2, v3, and v5 due to improper neutralization CVE-2026-891314.3SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthentic CVE-2026-891335.3wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstrain