Skip to content
NewA calmer, faster ZeroHour
Vulnerability1

CVE-2026-89126

Unauthenticated memory corruption in SAP Web Dispatcher

CVSS 3.1
10.0 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-89126 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP Web Dispatcher does not sufficiently validate certain network input handled by an internal component, allowing memory corruption (heap-based buffer overflow). An unauthenticated attacker can trigger it by sending specially crafted network traffic, with no user interaction. Successful exploitation can execute arbitrary code and fully compromise confidentiality, integrity, and availability. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-89126. SAP has not listed a fixed version or workaround.

ProductAffected
SAP Web Dispatcher—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Weakness
CWE-122
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

6 stories