CVE-2026-89125
MediumCVSS 6.0Summary
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to credential exposure and unauthorized access, resulting in a high impact on confidentiality and a low impact on integrity and availability.
Risk Assessment
Credential exposure could enable unauthorized access to systems and privilege escalation. The risk is significant as it involves administrative accounts and may span multiple deployments.
Recommendation
Apply the security updates provided by SAP for Web Dispatcher and Internet Communication Manager. Consider rotating potentially exposed credentials.
Other vulnerabilities in SAP Web Dispatcher
See all- CVE-2026-109800High
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could provide specially crafted input, causing the Web Dispatcher process to terminate without user interaction.
- CVE-2026-89126Critical
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-89119Critical
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in the administrator's session and potentially leading to full compromise of the underlying operating system.
- CVE-2026-76968Medium
SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server allow an authenticated low-privileged attacker to access certain administrative functionality or interfaces and obtain sensitive system state information, resulting in information disclosure. This could facilitate further attacks. The vulnerability has a high impact on confidentiality, with no impact on integrity or availability.
Original NVD description (English source)
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to credential exposure and unauthorized access. Successful exploitation could expose credentials and facilitate unauthorized access to affected systems, resulting in a high impact on confidentiality and a low impact on integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS