---
id: "CVE-2026-89119"
page: "https://infrastack.ai/live/CVE-2026-89119"
kind: "vulnerability"
aliases: ["CVE-2026-89119"]
title: "SAP Web Dispatcher and NetWeaver ABAP: CSRF in admin functions can lead to server takeover"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP Web Dispatcher", "fixed": [], "affected": "7.93, 9.16", "ecosystem": "vendor"}, {"name": "SAP NetWeaver Application Server ABAP (KERNEL / ICM)", "fixed": [], "affected": "7.93, 9.20, 9.21", "ecosystem": "vendor"}]
ecosystems: []
tags: ["csrf", "sap", "sap-netweaver", "sap-web-dispatcher", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T01:17:22+00:00"
first_seen_at: "2026-11-10T01:26:43+00:00"
updated_at: "2026-11-10T01:29:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89119", "first_seen_at": "2026-11-10T01:26:43+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-89119", "first_seen_at": "2026-11-10T01:29:26+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-89119", "https://me.sap.com/notes/3804858"]}]
exploit_sources: []
---

# SAP Web Dispatcher and NetWeaver ABAP: CSRF in admin functions can lead to server takeover

Link for people: https://infrastack.ai/live/CVE-2026-89119 (this .md is for agents)

SAP Web Dispatcher and the NetWeaver ABAP Internet Communication Manager do not validate requests in some administrative functions. An unauthenticated attacker who tricks a logged-on administrator into opening a malicious link can trigger unintended admin actions, which the sources say could lead to full compromise of the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP Web Dispatcher affected 7.93, 9.16 fixed no fixed version listed
- vendor:SAP NetWeaver Application Server ABAP (KERNEL / ICM) affected 7.93, 9.20, 9.21 fixed no fixed version listed

## How to check

Check the kernel/Web Dispatcher release and patch level (SAP GUI: System > Status, or sapwebdisp -v) against SAP Security Note 3804858 (me.sap.com, login required). CNA record lists affected WEBDISP 7.93, 9.16 and KERNEL 7.93, 9.20, 9.21 (possibly more). Fixed patch levels: unknown, read the note.

## Timeline

- 2026-11-10T01:26:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89119
- 2026-11-10T01:29:26+00:00 analyst https://app.opencve.io/cve/CVE-2026-89119 — SAP patch day 2026-11-10, Security Note 3804858 (me.sap.com, login-gated, unreadable); CNA record via OpenCVE gives CWE-352 CSRF, CVSS 9.6 AV:N/UI:R, affected WEBDISP 7.93/9.16, KERNEL 7.93/9.20/9.21 (list truncated in what I saw). Fixed patch levels and mitigations unknown; nothing verified. No exploitation or PoC reported. X not queried; web search worked.

## Documents

- [describes] OpenCVE: CVE-2026-89119 (mirrors SAP CNA record) https://app.opencve.io/cve/CVE-2026-89119
- [mentions] SAP Security Note 3804858 (login required, not readable) https://me.sap.com/notes/3804858

## From the sources

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_