{"id":"CVE-2026-89119","kind":"vulnerability","aliases":["CVE-2026-89119"],"related":[],"title":"SAP Web Dispatcher and NetWeaver ABAP: CSRF in admin functions can lead to server takeover","description":"SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.","summary":"SAP Web Dispatcher and the NetWeaver ABAP Internet Communication Manager do not validate requests in some administrative functions. An unauthenticated attacker who tricks a logged-on administrator into opening a malicious link can trigger unintended admin actions, which the sources say could lead to full compromise of the underlying operating system.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP Web Dispatcher","fixed":[],"affected":"7.93, 9.16","ecosystem":"vendor"},{"name":"SAP NetWeaver Application Server ABAP (KERNEL / ICM)","fixed":[],"affected":"7.93, 9.20, 9.21","ecosystem":"vendor"}],"ecosystems":[],"tags":["csrf","sap","sap-netweaver","sap-web-dispatcher","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check the kernel/Web Dispatcher release and patch level (SAP GUI: System > Status, or sapwebdisp -v) against SAP Security Note 3804858 (me.sap.com, login required). CNA record lists affected WEBDISP 7.93, 9.16 and KERNEL 7.93, 9.20, 9.21 (possibly more). Fixed patch levels: unknown, read the note.","fix":null,"status":"open","published_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","triaged_at":"2026-11-10T01:28:17+00:00","updated_at":"2026-11-10T01:29:26+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:28:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP Web Dispatcher and NetWeaver ABAP: admin link lets attacker control server","impact":"high","summary":"SAP Web Dispatcher and the NetWeaver ABAP Internet Communication Manager do not validate requests in some administrative functions. An unauthenticated attacker who tricks a logged-on administrator into opening a malicious link can trigger unintended admin actions, which the sources say could lead to full compromise of the underlying operating system.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","sap-netweaver","sap-web-dispatcher","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Full operating system compromise via administrator session actions","analyst_note":"Find SAP's security note for CVE-2026-89119 to get affected versions, fixed patch levels and any mitigation setting; the NVD entry alone gives none.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running SAP Web Dispatcher or SAP NetWeaver Application Server ABAP with the Internet Communication Manager are the exposed systems, and the attack needs a logged-on administrator to open a link. The sources do not list affected versions or the specific administrative functions involved. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000731,"input_tokens":4648,"output_tokens":532,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find SAP's security note for CVE-2026-89119 to get affected versions, fixed patch levels and any mitigation setting; the NVD entry alone gives none.","search":"'-2026':17A,20A '-89119':18A,21A 'abap':6A,29A,51B,105C,125C 'action':82B,151C 'admin':9A,81B 'administr':61B,72B,117C,139C,154C 'applic':103C,123C 'application':27A 'attack':65B,132C 'avail':179C 'caus':149C 'certain':116C 'communic':53B,107C 'compromis':91B,164C 'confidenti':176C 'context':121C 'could':87B,133C,148C,159C 'csrf':7A,32B 'cve':16A,19A 'dispatch':3A,40B,47B,99C,129C 'dispatcher':24A 'exploit':158C 'full':90B,163C 'function':10A,62B,118C 'high':173C 'host':43B 'icm':31A 'impact':174C 'integr':177C 'internet':52B,106C 'kernel':30A 'lead':12A,88B,160C 'link':77B,144C,147C 'log':70B,137C 'logged-on':69B,136C 'malici':76B,143C 'manag':54B,108C 'netweav':5A,36B,50B,102C 'netweaver':26A 'open':74B 'oper':95B,168C 'perform':111C 'request':58B,113C 'result':170C 'sap':1A,22A,25A,33B,35B,38B,45B,97C,101C,127C 'sap-netweav':34B 'sap-web-dispatch':37B 'say':86B 'self':42B 'self-host':41B 'server':14A,28A,104C,124C 'session':156C 'sourc':85B 'success':157C 'suffici':112C 'system':96B,169C 'takeov':15A 'trick':67B,134C 'trigger':79B 'unauthent':64B,131C 'under':94B,167C 'unintend':80B,150C 'valid':57B,114C 'vendor':44B 'visit':141C,145C 'web':2A,23A,39B,46B,98C,128C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP Web Dispatcher or SAP NetWeaver Application Server ABAP with the Internet Communication Manager are the exposed systems, and the attack needs a logged-on administrator to open a link. The sources do not list affected versions or the specific administrative functions involved. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["netweaverapplicationserverabapkernelicm","sapnetweaverapplicationserverabapkernelicm","sapwebdispatcher","webdispatcher"],"ptokens":["abap","application","dispatcher","icm","kernel","netweaver","sap","server","web"],"labels":["critical","csrf","sap","sapnetweaver","sapwebdispatcher","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':17A,20A '-89119':18A,21A 'abap':6A,29A 'admin':9A 'application':27A 'csrf':7A 'cve':16A,19A 'dispatch':3A 'dispatcher':24A 'function':10A 'icm':31A 'kernel':30A 'lead':12A 'netweav':5A 'netweaver':26A 'sap':1A,22A,25A 'server':14A,28A 'takeov':15A 'web':2A,23A","search_b":"'abap':51B 'action':82B 'admin':81B 'administr':61B,72B 'attack':65B 'communic':53B 'compromis':91B 'could':87B 'csrf':32B 'dispatch':40B,47B 'full':90B 'function':62B 'host':43B 'internet':52B 'lead':88B 'link':77B 'log':70B 'logged-on':69B 'malici':76B 'manag':54B 'netweav':36B,50B 'open':74B 'oper':95B 'request':58B 'sap':33B,35B,38B,45B 'sap-netweav':34B 'sap-web-dispatch':37B 'say':86B 'self':42B 'self-host':41B 'sourc':85B 'system':96B 'trick':67B 'trigger':79B 'unauthent':64B 'under':94B 'unintend':80B 'valid':57B 'vendor':44B 'web':39B,46B","search_c":"'abap':105C,125C 'action':151C 'administr':117C,139C,154C 'applic':103C,123C 'attack':132C 'avail':179C 'caus':149C 'certain':116C 'communic':107C 'compromis':164C 'confidenti':176C 'context':121C 'could':133C,148C,159C 'dispatch':99C,129C 'exploit':158C 'full':163C 'function':118C 'high':173C 'impact':174C 'integr':177C 'internet':106C 'lead':160C 'link':144C,147C 'log':137C 'logged-on':136C 'malici':143C 'manag':108C 'netweav':102C 'oper':168C 'perform':111C 'request':113C 'result':170C 'sap':97C,101C,127C 'server':104C,124C 'session':156C 'success':157C 'suffici':112C 'system':169C 'trick':134C 'unauthent':131C 'under':167C 'unintend':150C 'valid':114C 'visit':141C,145C 'web':98C,128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89119","severity":null,"published_at":"2026-11-10T01:17:22+00:00","modified_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","fetched_at":"2026-11-10T01:26:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89119:2369","url":"https://app.opencve.io/cve/CVE-2026-89119","severity":null,"published_at":"2026-11-10T01:29:26+00:00","modified_at":"2026-11-10T01:29:26+00:00","first_seen_at":"2026-11-10T01:29:26+00:00","fetched_at":"2026-11-10T01:29:26+00:00","note":"SAP patch day 2026-11-10, Security Note 3804858 (me.sap.com, login-gated, unreadable); CNA record via OpenCVE gives CWE-352 CSRF, CVSS 9.6 AV:N/UI:R, affected WEBDISP 7.93/9.16, KERNEL 7.93/9.20/9.21 (list truncated in what I saw). Fixed patch levels and mitigations unknown; nothing verified. No exploitation or PoC reported. X not queried; web search worked.","cites":["https://app.opencve.io/cve/CVE-2026-89119","https://me.sap.com/notes/3804858"]}],"documents":[{"id":112437,"url":"https://app.opencve.io/cve/CVE-2026-89119","title":"OpenCVE: CVE-2026-89119 (mirrors SAP CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112438,"url":"https://me.sap.com/notes/3804858","title":"SAP Security Note 3804858 (login required, not readable)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}