CVE-2026-89120

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

• CWE-1188

• https://me.sap.com/notes/3626303
• https://url.sap/sapsecuritypatchday

Published

Oct 13, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89112The admin API endpoint used to retrieve CLA signature record…6.5
• CVE-2026-89113SAP Commerce Cloud does not sufficiently validate certain us…8.8
• CVE-2026-89116The affected code used child_process.execSync with a shell s…5.9
• CVE-2026-89117SAP NetWeaver Enterprise Portal allows an unauthenticated at…6.1
• CVE-2026-89118SAP NetWeaver Enterprise Portal allows an unauthenticated at…5.3
• CVE-2026-8912The Contest Gallery plugin for WordPress is vulnerable to SQ…7.5
• CVE-2026-89121SAP S/4HANA does not perform sufficient instance-level autho…4.7
• CVE-2026-89122SAP NetWeaver Enterprise Portal does not sufficiently valida…6.1
• CVE-2026-89124Display Product Catalog Based on Customs Declaration applica…4.3
• CVE-2026-8913A command Injection vulnerability exists in the WireGuard cl…8.5
• CVE-2026-89133wolfSSL versions 5.9.2 and earlier contain a flaw in the X.5…5.3
• CVE-2026-89134A certificate with no dNSName SAN but another SAN type prese…9.1