CVE-2026-89110

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

• CWE-749

• https://me.sap.com/notes/3797111
• https://url.sap/sapsecuritypatchday

Published

Oct 13, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89102In wolfSSL versions 5.7.2 through 5.9.2 there is a client-si…6.5
• CVE-2026-89105The HybridTokenAuthenticator component of the SAP/cloud-secu…4.2
• CVE-2026-89106SAP UI5 does not perform sufficient input validation under c…4.4
• CVE-2026-89107SAP S/4HANA (Manage Substitution/Validation Rules) does not …9.9
• CVE-2026-89108SAP Manufacturing Integration and Intelligence does not suff…9.1
• CVE-2026-8911The WP AutoBuzz plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2026-89111The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnera…10
• CVE-2026-89112The admin API endpoint used to retrieve CLA signature record…6.5
• CVE-2026-89113SAP Commerce Cloud does not sufficiently validate certain us…8.8
• CVE-2026-89116The affected code used child_process.execSync with a shell s…5.9
• CVE-2026-89117SAP NetWeaver Enterprise Portal allows an unauthenticated at…6.1
• CVE-2026-89118SAP NetWeaver Enterprise Portal allows an unauthenticated at…5.3