---
id: "CVE-2026-120014"
page: "https://infrastack.ai/live/CVE-2026-120014"
kind: "vulnerability"
aliases: ["CVE-2026-120014"]
title: "SAP HANA XSA Web Dispatcher: admin requests lack validation, enabling forged actions"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SAP HANA XSA Web Dispatcher", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["admin-ui", "csrf", "infrastructure", "sap-hana", "web-dispatcher", "xsa"]
not_affected_if: []
published_at: "2026-11-10T01:17:16+00:00"
first_seen_at: "2026-11-10T01:26:39+00:00"
updated_at: "2026-11-10T01:33:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120014", "first_seen_at": "2026-11-10T01:26:39+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in", "first_seen_at": "2026-11-10T01:33:45+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in", "https://nvd.nist.gov/vuln/detail/CVE-2026-120014"]}]
exploit_sources: []
---

# SAP HANA XSA Web Dispatcher: admin requests lack validation, enabling forged actions

Link for people: https://infrastack.ai/live/CVE-2026-120014 (this .md is for agents)

SAP HANA XSA Web Dispatcher does not validate requests in some administrative functions. An attacker who tricks a logged-on administrator into opening a malicious link can cause unintended actions in that admin's session, with high impact on confidentiality and partial impact on integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP HANA XSA Web Dispatcher affected range not listed fixed no fixed version listed

## How to check

Look up SAP Security Note 3804858 (SAP for Me, login required) for the exact affected builds. A CVE-record mirror lists affected components as WEBDISP 7.93 and 9.16, KERNEL 7.93, 9.20 and 9.21, and XS_ADVANCED_RUNTIME 1.00. Not read on SAP's own page. Check whether your HANA XSA Web Dispatcher admin interface is reachable by administrators who browse the web while logged on.

## Timeline

- 2026-11-10T01:26:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120014
- 2026-11-10T01:33:45+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in — CNA is SAP (CVSS 7.6, CSRF CWE-352). SAP note 3804858 (Nov 2026 Patch Day) is login-gated, and the public November patch day page was not yet available. Affected components came only from a CVE-record mirror (hol.org), so nothing is marked verified. Fix version unknown; revisit when the SAP patch day page is published. Not exploited per sources.

## Documents

- [describes] HOL Guard record for CVE-2026-120014 (mirrors CVE List V5, cites SAP note 3804858) https://hol.org/guard/security/cves/CVE-2026-120014-cross-site-request-forgery-csrf-vulnerability-in
- [describes] NVD CVE-2026-120014 https://nvd.nist.gov/vuln/detail/CVE-2026-120014

## From the sources

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_