CVE-2026-89110

9.9 CRITICAL

Published 2026-10-13 · Updated 2026-10-15

AI risk analysis

Summary: SAP NetWeaver Visual Composer lacks proper authorization checks, allowing low-privilege attackers to invoke internal operations on remote systems. This can lead to full system compromise depending on remote connection configuration.
Exploitability: Exploitation requires a low-privilege user account with access to the affected portal functionality, and is relatively straightforward once the vulnerability is identified.
Blast radius: The impact could be extensive as attackers may gain full control over remote systems, potentially leading to data breaches, system manipulation, and service disruption across the organization's SAP infrastructure.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Apply the latest SAP Note 3215900 which contains the fix for this vulnerability in SAP NetWeaver Visual Composer.

sapauthorizationremote

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-749

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.