CVE-2026-89126
SAP_SE SAP Web Dispatcher
Published 10 Nov 2026 · updated 10 Nov 2026 · Received
10.0 Critical · CVSS 3.1, sap.com
Description
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.