Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-89103

Incorrect authorization via SAP Gateway default ACL

CVSS 3.1
10.0 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-89103 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP Gateway enables a default access control list that grants high privileges and treats an external caller as an internal application server. An unauthenticated attacker with network access to the Gateway can use this weakness to perform unauthorized actions in the application environment, with high impact on confidentiality, integrity, and availability. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-89103. SAP has not named a fixed version or workaround.

ProductAffected
SAP Gateway—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

Weakness
CWE-863
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

6 stories