SAP GATEWAY · CVE-2026-89103 · Infrastructure
NO FIX YET
The CVE record says SAP Gateway activates a default Access Control List with high privileges, so an external attacker can be classified as an internal application server. An unauthenticated attacker with network access to the gateway could then perform unauthorized actions, with high impact on confidentiality, integrity and availability (CVSS 10.0). The record lists KRNL64NUC 7.22; the fixed level is not yet confirmed from SAP's note.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Who cares sap, sap-gateway, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.