CVE-2026-89126 · Infrastructure
NO FIX YET
SAP Web Dispatcher fails to validate certain network input handled by an internal component, causing memory corruption. An unauthenticated attacker sending crafted traffic could execute arbitrary code and fully compromise the server.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP Web Dispatcher instances that receive network traffic from untrusted sources are exposed, since the flaw is reachable without authentication. Teams that run SAP landscapes should check whether their Web Dispatchers are internet-facing or reachable from untrusted networks. Sites that do not run SAP Web Dispatcher are not affected.
Not affected if no-web-dispatcher
Who cares sap, sap-web-dispatcher, self-hosted
Unknown from the sources.
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.