CVE-2026-89119
CriticalCVSS 9.6Summary
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in the administrator's session and potentially leading to full compromise of the underlying operating system.
Risk Assessment
Exploitation could lead to full compromise of the underlying operating system, posing a high risk to confidentiality, integrity, and availability.
Recommendation
Apply the SAP patch and train administrators to avoid suspicious links and verify the origin of administrative requests.
Other vulnerabilities in SAP Web Dispatcher
See all- CVE-2026-89125Medium
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to credential exposure and unauthorized access, resulting in a high impact on confidentiality and a low impact on integrity and availability.
- CVE-2026-109800High
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could provide specially crafted input, causing the Web Dispatcher process to terminate without user interaction.
- CVE-2026-89126Critical
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-76968Medium
SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server allow an authenticated low-privileged attacker to access certain administrative functionality or interfaces and obtain sensitive system state information, resulting in information disclosure. This could facilitate further attacks. The vulnerability has a high impact on confidentiality, with no impact on integrity or availability.
Original NVD description (English source)
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS