CVE-2026-89126
CriticalCVSS 10.0Summary
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
Risk Assessment
The vulnerability allows an unauthenticated network attacker to fully compromise the system, posing a high risk to confidentiality, integrity, and availability.
Recommendation
Apply the vendor-provided SAP patch as soon as possible and restrict network access to SAP Web Dispatcher to trusted sources.
Other vulnerabilities in SAP Web Dispatcher
See all- CVE-2026-89125Medium
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to credential exposure and unauthorized access, resulting in a high impact on confidentiality and a low impact on integrity and availability.
- CVE-2026-109800High
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could provide specially crafted input, causing the Web Dispatcher process to terminate without user interaction.
- CVE-2026-89119Critical
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in the administrator's session and potentially leading to full compromise of the underlying operating system.
- CVE-2026-76968Medium
SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server allow an authenticated low-privileged attacker to access certain administrative functionality or interfaces and obtain sensitive system state information, resulting in information disclosure. This could facilitate further attacks. The vulnerability has a high impact on confidentiality, with no impact on integrity or availability.
Original NVD description (English source)
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS