CVE-2026-89126

CVE Enrichment

CVSS: 10.0 CRITICAL
CISA KEV: Not listed

Description

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 10-Nov-2026 08:17
Last Modified: 10-Nov-2026 08:17
CWE: CWE-122

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

SAP_SE · SAP Web Dispatcher Source: CNA · [email protected]
Default status: unaffected

HDB 2.00 — affected
KRNL64UC 7.53 — affected
WEBDISP 7.53 — affected
7.54 — affected
7.77 — affected
7.93 — affected
9.16 — affected
XS_ADVANCED_RUNTIME 1.00 — affected
SAP_EXTENDED_APP_SERVICES 1 — affected
KERNEL 7.53 — affected
9.18 — affected
9.20 — affected

References

Last enrichment sync: 10-Nov-2026 19:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

In the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory. An attacker who succeeds could then run code and fully compromise the system. SAP Fixes Four Maximum-Severity Flaws, Including Two That Could Enable Remote Code Execution
The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. SAP Fixes Four Maximum-Severity Flaws in November Security Update

CVE (7)

MITRE ATT&CK (1)

Vendors (1)

Products (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.