CVE-2026-89119

Summary

This is a cross-site request forgery (CSRF) vulnerability in SAP Web Dispatcher and SAP NetWeaver ABAP's Internet Communication Manager where insufficient request validation allows unauthenticated attackers to trick authenticated administrators into executing unintended administrative actions via malicious links. Successful exploitation can lead to full system compromise, including OS-level control.

Exploitability

Exploitation requires social engineering to lure a logged-in administrator to click a crafted link while authenticated; no authentication bypass or direct network access is needed beyond the victim's session.

Blast radius

If exploited, attackers could execute arbitrary administrative commands on the SAP system, potentially leading to full compromise of the underlying OS and all data processed by the SAP environment.

Detection

Defenders should monitor SAP HTTP access logs (e.g., dev_w* files or ICM logs) for unexpected POST/GET requests to administrative paths (e.g., /sap/public/ping, /sap/bc/bsp, /sap/admin) originating from external IPs or unusual user agents during off-hours; also watch for anomalous referer headers pointing to non-SAP domains in admin endpoint requests.

Prioritized remediation

Apply SAP Security Note 3284765 (for NetWeaver ABAP) or the equivalent patch for SAP Web Dispatcher as specified in SAP Note 3284766; if patches cannot be applied immediately, disable administrative HTTP endpoints accessible via public URLs and enforce strict CSRF token validation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.