Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-89119

CSRF in SAP Web Dispatcher and NetWeaver ICM admin functions

CVSS 3.1
9.6 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-89119 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not sufficiently validate requests in certain administrative functions. An unauthenticated attacker on the network can trick a logged-on administrator into opening a malicious link, which then runs unintended actions in that session. Successful abuse can fully compromise the underlying operating system. Administrators of those SAP components are affected.

What to do: Apply SAP's update for CVE-2026-89119. SAP has not listed a fixed version or workaround.

ProductAffected
SAP Web Dispatcher—
SAP NetWeaver Application Server ABAP (Internet Communication Manager)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.

Weakness
CWE-352
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

3 stories