CVSS 3.1
9.6 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVE-2026-89119
Critical (9.6) in sap se sap web dispatcher and internet communication manager. EPSS 0.1% estimated probability of exploitation activity in the next 30 days.
On this page
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
Severity
- EPSS
- 0.1% estimated probability of exploitation activity in the next 30 days; 4th percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-352 Cross-Site Request Forgery (Cross Site Reference Forgery)
- OWASP Top 10
- A01:2025 Broken Access Control
- Published
- Assigned by
- sap (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-89119 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-89119?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-89119?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-89119 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Affected
- sap_se:sap web dispatcher and internet communication manager
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| SAP_SE SAP Web Dispatcher and Internet Communication Manager | WEBDISP 7.93 |
| SAP_SE SAP Web Dispatcher and Internet Communication Manager | 9.16 |
| SAP_SE SAP Web Dispatcher and Internet Communication Manager | XS_ADVANCED_RUNTIME 1.00 |
| SAP_SE SAP Web Dispatcher and Internet Communication Manager | KERNEL 7.93 |
| SAP_SE SAP Web Dispatcher and Internet Communication Manager | 9.20 |
| SAP_SE SAP Web Dispatcher and Internet Communication Manager | 9.21 |
Attack patterns (CAPEC)
- CAPEC-62 Cross Site Request Forgery Likelihood: High · Severity: Very High
- CAPEC-111 JSON Hijacking (aka JavaScript Hijacking) Likelihood: High · Severity: High
- CAPEC-462 Cross-Domain Search Timing Severity: Medium
- CAPEC-467 Cross Site Identification Severity: Low
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.