{"id":"CVE-2026-89103","kind":"vulnerability","aliases":["CVE-2026-89103"],"related":[],"title":"SAP Gateway: default access control list trusts external attackers as internal servers","description":"SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.","summary":"The CVE record says SAP Gateway activates a default Access Control List with high privileges, so an external attacker can be classified as an internal application server. An unauthenticated attacker with network access to the gateway could then perform unauthorized actions, with high impact on confidentiality, integrity and availability (CVSS 10.0). The record lists KRNL64NUC 7.22; the fixed level is not yet confirmed from SAP's note.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP Gateway","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","sap","sap-gateway","self-hosted"],"not_affected_if":[],"how_to_check":"Unconfirmed, from the CVE record only: the listed component is the SAP kernel KRNL64NUC 7.22. Check your gateway ACLs: reginfo and secinfo are the files that decide who counts as an internal server, and the default rules apply when profile parameter gw/acl_mode = 1 (SAP community write-up, not the vendor note for this CVE). Then find the SAP Security Note for CVE-2026-89103 in SAP for Me for the fixed kernel patch level.","fix":null,"status":"open","published_at":"2026-11-10T01:17:21+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","triaged_at":"2026-11-10T01:28:06+00:00","updated_at":"2026-11-10T01:29:20+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T01:28:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP Gateway: default access control list trusts external attackers as internal servers","impact":"high","summary":"SAP Gateway ships with a default Access Control List that grants high privileges and lets an external attacker be classified as an internal application server. An unauthenticated attacker with network access to the gateway could perform unauthorized actions inside the SAP application environment.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sap","sap-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker performs unauthorized actions in SAP environment","analyst_note":"Check SAP Security Notes for CVE-2026-89103 for affected releases, fixed patch level and the ACL setting to change; the NVD entry alone gives no versions.","how_to_check":"unknown","plain_action":"","product_name":"SAP Gateway","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000667,"input_tokens":4565,"output_tokens":421,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check SAP Security Notes for CVE-2026-89103 for affected releases, fixed patch level and the ACL setting to change; the NVD entry alone gives no versions.","search":"'-2026':14A,17A '-89103':15A,18A '10.0':79B '7.22':84B 'access':4A,38B,61B,101C,124C 'action':69B,137C 'activ':35B,98C 'affect':155C 'allow':107C 'applic':54B,114C,140C 'attack':9A,47B,58B,111C,121C 'avail':77B,152C 'categor':108C 'classifi':50B 'confidenti':74B,149C 'confirm':91B 'control':5A,39B,102C 'could':65B,129C 'cve':13A,16A,30B 'cvss':78B 'default':3A,37B,100C 'environ':141C 'exploit':130C 'extern':8A,46B,110C 'fix':86B 'gateway':2A,20A,25B,34B,64B,97C,128C 'high':42B,71B,105C,145C 'host':28B 'impact':72B,146C 'infrastructur':21B 'integr':75B,150C 'intern':11A,53B,113C 'krnl64nuc':83B 'level':87B 'list':6A,40B,82B,103C 'network':60B,123C 'note':95B 'perform':67B,135C 'potenti':134C 'privileg':43B,106C 'record':31B,81B 'result':118C,142C 'sap':1A,19A,22B,24B,33B,93B,96C,127C 'sap-gateway':23B 'say':32B 'self':27B 'self-host':26B 'server':12A,55B,115C 'system':156C 'trust':7A 'unauthent':57B,120C 'unauthor':68B,136C 'weak':132C 'within':138C 'yet':90B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["gateway","sapgateway"],"ptokens":["gateway","sap"],"labels":["critical","infrastructure","sap","sapgateway","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-89103':15A,18A 'access':4A 'attack':9A 'control':5A 'cve':13A,16A 'default':3A 'extern':8A 'gateway':2A,20A 'intern':11A 'list':6A 'sap':1A,19A 'server':12A 'trust':7A","search_b":"'10.0':79B '7.22':84B 'access':38B,61B 'action':69B 'activ':35B 'applic':54B 'attack':47B,58B 'avail':77B 'classifi':50B 'confidenti':74B 'confirm':91B 'control':39B 'could':65B 'cve':30B 'cvss':78B 'default':37B 'extern':46B 'fix':86B 'gateway':25B,34B,64B 'high':42B,71B 'host':28B 'impact':72B 'infrastructur':21B 'integr':75B 'intern':53B 'krnl64nuc':83B 'level':87B 'list':40B,82B 'network':60B 'note':95B 'perform':67B 'privileg':43B 'record':31B,81B 'sap':22B,24B,33B,93B 'sap-gateway':23B 'say':32B 'self':27B 'self-host':26B 'server':55B 'unauthent':57B 'unauthor':68B 'yet':90B","search_c":"'access':101C,124C 'action':137C 'activ':98C 'affect':155C 'allow':107C 'applic':114C,140C 'attack':111C,121C 'avail':152C 'categor':108C 'confidenti':149C 'control':102C 'could':129C 'default':100C 'environ':141C 'exploit':130C 'extern':110C 'gateway':97C,128C 'high':105C,145C 'impact':146C 'integr':150C 'intern':113C 'list':103C 'network':123C 'perform':135C 'potenti':134C 'privileg':106C 'result':118C,142C 'sap':96C,127C 'server':115C 'system':156C 'unauthent':120C 'unauthor':136C 'weak':132C 'within':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89103","severity":null,"published_at":"2026-11-10T01:17:21+00:00","modified_at":"2026-11-10T01:17:21+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","fetched_at":"2026-11-10T01:26:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89103:2370","url":"https://cve.imfht.com/detail/CVE-2026-89103","severity":null,"published_at":"2026-11-10T01:29:20+00:00","modified_at":"2026-11-10T01:29:20+00:00","first_seen_at":"2026-11-10T01:29:20+00:00","fetched_at":"2026-11-10T01:29:20+00:00","note":"SAP's own note (SAP for Me, login) and the Nov 2026 patch day page were not reachable; only a mirror of the CVE List V5 record read (CVSS 3.1 10.0, AV:N/PR:N, scope changed; listed component KRNL64NUC 7.22). No fixed version, note number or ACL setting confirmed; nothing verified. No PoC or exploitation reported in sources read. Exa search worked; X not checked. To settle: read the SAP Security Note for this CVE on SAP for Me.","cites":["https://cve.imfht.com/detail/CVE-2026-89103"]}],"documents":[{"id":112436,"url":"https://cve.imfht.com/detail/CVE-2026-89103","title":"CVE-2026-89103 (mirror of CVE List V5 record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}