Patchfirst
Patchfirst
CVE-2026-89110 Critical · 9.9 EPSS 0.4%

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality

SAP_SE · SAP NetWeaver Visual Composer

Summary

SAP NetWeaver Visual Composer, a component of SAP NetWeaver, fails to perform sufficient authorization checks in certain portal functionality. An attacker with low privileges and network access can invoke internal operations on a preconfigured remote system without user interaction, which may lead to full compromise of that remote system depending on its connection configuration.

Official description · NVD

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

Breakdown
16.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 13 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

Other 2

me.sap.com/notes/3797111url.sap/sapsecuritypatchday
↑ ↓ chooseEnter openEsc close