CVE-2026-89126

Published Nov 10, 2026

Last updated 3 days ago

CVSS critical 10.0
SAP
onapsis

Overview

Description
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Source
cna@sap.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-122

Social media

Hype score
Not currently trending

  1. SAP patches four CVSS 10.0 bugs. All pre-auth. ICM2SHELL and PROXYGATE. CVE-2026-76964 and CVE-2026-89126 : memory corruption in the ICM and Web Dispatcher. RCE on the component that faces the network by design. CVE-2026-89103 "PROXYGATE" : SAP Gateway believes an external

    @SaifuddinAmri__

    11 Nov 2026

    197 Impressions

    0 Retweets

    3 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  2. SAP's November Patch Day brings 35 new notes, including four CVSS 10.0 flaws in NetWeaver: ICM (CVE-2026-76964), Web Dispatcher (CVE-2026-89126), Gateway (CVE-2026-89103) and the ABAP SAML2 provider (CVE-2026-120017). No exploitation reported yet. https://t.co/qEgixgFApn

    @CipherSecurityN

    10 Nov 2026

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Four CVSS 10.0 SAP flaws patched in a single day — ICM2SHELL (CVE-2026-76964 / CVE-2026-89126) enables unauthenticated RCE via malformed WebSocket frames, while PROXYGATE (CVE-2026-89103) lets external attackers impersonate trusted internal application servers. After initial

    @aviatrixtrc

    10 Nov 2026

    58 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🚨 SAP NetWeaver / Web Dispatcher — Kritik Güvenlik Açıkları! — CVE-2026-76964: ICM bellek bozulması / RCE — CVE-2026-89126: Web Dispatcher bellek bozulması / RCE — CVE-2026-89103: SAP Gateway erişim kontrolü açığı — CVE-2026-120017: SAML2 kimlik doğrula

    @ridvanyagli

    10 Nov 2026

    92 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. SAP fixed four CVSS 10.0 flaws (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) enabling pre-auth RCE and auth bypass in NetWeaver and Web Dispatcher. Restrict port 33xx now. https://t.co/HCGeiHJZcX https://t.co/QC14eBVf0C #2workly

    @2Workly

    10 Nov 2026

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2026-44772
  2. SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.•CVE-2026-89103
  3. SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.•CVE-2026-76964
  4. SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.•CVE-2026-120017
  5. SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.•CVE-2026-89107

References

Sources include official advisories and independent security research.