---
id: "CVE-2026-89103"
page: "https://infrastack.ai/live/CVE-2026-89103"
kind: "vulnerability"
aliases: ["CVE-2026-89103"]
title: "SAP Gateway: default access control list trusts external attackers as internal servers"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SAP Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "sap", "sap-gateway", "self-hosted"]
not_affected_if: []
published_at: "2026-11-10T01:17:21+00:00"
first_seen_at: "2026-11-10T01:26:43+00:00"
updated_at: "2026-11-10T01:29:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89103", "first_seen_at": "2026-11-10T01:26:43+00:00"}, {"source": "analyst", "url": "https://cve.imfht.com/detail/CVE-2026-89103", "first_seen_at": "2026-11-10T01:29:20+00:00", "cites": ["https://cve.imfht.com/detail/CVE-2026-89103"]}]
exploit_sources: []
---

# SAP Gateway: default access control list trusts external attackers as internal servers

Link for people: https://infrastack.ai/live/CVE-2026-89103 (this .md is for agents)

The CVE record says SAP Gateway activates a default Access Control List with high privileges, so an external attacker can be classified as an internal application server. An unauthenticated attacker with network access to the gateway could then perform unauthorized actions, with high impact on confidentiality, integrity and availability (CVSS 10.0). The record lists KRNL64NUC 7.22; the fixed level is not yet confirmed from SAP's note.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP Gateway affected range not listed fixed no fixed version listed

## How to check

Unconfirmed, from the CVE record only: the listed component is the SAP kernel KRNL64NUC 7.22. Check your gateway ACLs: reginfo and secinfo are the files that decide who counts as an internal server, and the default rules apply when profile parameter gw/acl_mode = 1 (SAP community write-up, not the vendor note for this CVE). Then find the SAP Security Note for CVE-2026-89103 in SAP for Me for the fixed kernel patch level.

## Timeline

- 2026-11-10T01:26:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89103
- 2026-11-10T01:29:20+00:00 analyst https://cve.imfht.com/detail/CVE-2026-89103 — SAP's own note (SAP for Me, login) and the Nov 2026 patch day page were not reachable; only a mirror of the CVE List V5 record read (CVSS 3.1 10.0, AV:N/PR:N, scope changed; listed component KRNL64NUC 7.22). No fixed version, note number or ACL setting confirmed; nothing verified. No PoC or exploitation reported in sources read. Exa search worked; X not checked. To settle: read the SAP Security Note for this CVE on SAP for Me.

## Documents

- [describes] CVE-2026-89103 (mirror of CVE List V5 record) https://cve.imfht.com/detail/CVE-2026-89103

## From the sources

SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_