CVE-2026-89103
SAP_SE SAP Gateway
Published 10 Nov 2026 · updated 10 Nov 2026 · Received
10.0 Critical · CVSS 3.1, sap.com
Description
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.