CVE-2026-89110

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 0.31%
EPSS Percentile: 22.31%
CISA KEV: Not listed

Description

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cna@sap.com
Published: 13-Oct-2026 08:16
Last Modified: 13-Oct-2026 21:17
EPSS Date: 2026-10-13
CWE: CWE-749

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 13-Oct-2026 23:12
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Next in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer. SAP Patches Critical NetWeaver, S/4HANA and Other Vulnerabilities
Today, SAP also addressed CVE-2026-89110, a critical broken access control vulnerability in the SAP NetWeaver Visual Composer that could let remote attackers with limited privileges fully compromise vulnerable systems. SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python SDK

CVE (5)

People (2)

Vendors (1)

Products (10)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.