{"id":"CVE-2026-89126","kind":"vulnerability","aliases":["CVE-2026-89126"],"related":[],"title":"SAP Web Dispatcher: unvalidated network input lets unauthenticated attackers run code","description":"SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","summary":"SAP Web Dispatcher fails to validate certain network input handled by an internal component, causing memory corruption. An unauthenticated attacker sending crafted traffic could execute arbitrary code and fully compromise the server.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","sap","sap-web-dispatcher","self-hosted"],"not_affected_if":["no-web-dispatcher"],"how_to_check":"- Identify SAP Web Dispatcher instances in your environment and record their release and patch level.\n- Compare the installed patch level against the SAP security note for this CVE (unknown from the sources).","fix":null,"status":"open","published_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:44+00:00","triaged_at":"2026-11-10T01:28:07+00:00","updated_at":"2026-11-10T01:29:16+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T01:28:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP Web Dispatcher: unvalidated network input lets unauthenticated attackers run code","impact":"high","summary":"SAP Web Dispatcher fails to validate certain network input handled by an internal component, causing memory corruption. An unauthenticated attacker sending crafted traffic could execute arbitrary code and fully compromise the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sap","sap-web-dispatcher","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker executes arbitrary code on the server","analyst_note":"Find the SAP security note and affected release/patch ranges for CVE-2026-89126 on the SAP Support Portal; the NVD entry gives no versions or fix.","how_to_check":"- Identify SAP Web Dispatcher instances in your environment and record their release and patch level.\n- Compare the installed patch level against the SAP security note for this CVE (unknown from the sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-web-dispatcher"],"who_is_affected":"SAP Web Dispatcher instances that receive network traffic from untrusted sources are exposed, since the flaw is reachable without authentication. Teams that run SAP landscapes should check whether their Web Dispatchers are internet-facing or reachable from untrusted networks. Sites that do not run SAP Web Dispatcher are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4577,"output_tokens":572,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the SAP security note and affected release/patch ranges for CVE-2026-89126 on the SAP Support Portal; the NVD entry gives no versions or fix.","search":"'-2026':13A,16A '-89126':14A,17A 'affect':91C 'allow':96C 'arbitrari':52B,101C 'attack':9A,46B,76C,98C 'avail':117C 'caus':41B 'certain':33B,66C 'code':11A,53B,102C 'compon':40B,73C 'compromis':56B,105C 'condit':88C 'confidenti':114C 'corrupt':43B,87C 'could':50B,77C,95C 'craft':48B,80C 'cve':12A,15A 'dispatch':3A,23B,29B,61C 'execut':51B,100C 'exploit':94C 'fail':30B 'fulli':55B,104C 'function':92C 'handl':36B 'high':111C 'host':26B 'impact':112C 'infrastructur':18B 'input':6A,35B,68C 'integr':115C 'intern':39B,72C 'let':7A 'memori':42B,86C 'network':5A,34B,67C,81C 'process':69C 'result':108C 'run':10A 'sap':1A,19B,21B,27B,59C 'sap-web-dispatch':20B 'self':25B 'self-host':24B 'send':47B,78C 'server':58B 'special':79C 'success':93C 'suffici':64C 'system':107C,120C 'traffic':49B,82C 'trigger':84C 'unauthent':8A,45B,75C 'unvalid':4A 'valid':32B,65C 'web':2A,22B,28B,60C","nicknames":[],"mitigations":[],"who_affected":"SAP Web Dispatcher instances that receive network traffic from untrusted sources are exposed, since the flaw is reachable without authentication. Teams that run SAP landscapes should check whether their Web Dispatchers are internet-facing or reachable from untrusted networks. Sites that do not run SAP Web Dispatcher are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","sap","sapwebdispatcher","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-89126':14A,17A 'attack':9A 'code':11A 'cve':12A,15A 'dispatch':3A 'input':6A 'let':7A 'network':5A 'run':10A 'sap':1A 'unauthent':8A 'unvalid':4A 'web':2A","search_b":"'arbitrari':52B 'attack':46B 'caus':41B 'certain':33B 'code':53B 'compon':40B 'compromis':56B 'corrupt':43B 'could':50B 'craft':48B 'dispatch':23B,29B 'execut':51B 'fail':30B 'fulli':55B 'handl':36B 'host':26B 'infrastructur':18B 'input':35B 'intern':39B 'memori':42B 'network':34B 'sap':19B,21B,27B 'sap-web-dispatch':20B 'self':25B 'self-host':24B 'send':47B 'server':58B 'traffic':49B 'unauthent':45B 'valid':32B 'web':22B,28B","search_c":"'affect':91C 'allow':96C 'arbitrari':101C 'attack':76C,98C 'avail':117C 'certain':66C 'code':102C 'compon':73C 'compromis':105C 'condit':88C 'confidenti':114C 'corrupt':87C 'could':77C,95C 'craft':80C 'dispatch':61C 'execut':100C 'exploit':94C 'fulli':104C 'function':92C 'high':111C 'impact':112C 'input':68C 'integr':115C 'intern':72C 'memori':86C 'network':67C,81C 'process':69C 'result':108C 'sap':59C 'send':78C 'special':79C 'success':93C 'suffici':64C 'system':107C,120C 'traffic':82C 'trigger':84C 'unauthent':75C 'valid':65C 'web':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89126","severity":null,"published_at":"2026-11-10T01:17:22+00:00","modified_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:44+00:00","fetched_at":"2026-11-10T01:26:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89126:2368","url":null,"severity":null,"published_at":"2026-11-10T01:29:16+00:00","modified_at":"2026-11-10T01:29:16+00:00","first_seen_at":"2026-11-10T01:29:16+00:00","fetched_at":"2026-11-10T01:29:16+00:00","note":"Could not find CVE-2026-89126 on SAP's own Sep or Oct 2026 patch-day pages (checked in full). The Nov 2026 page returned 404 on 2026-11-10, patch day itself, so it may not be published yet. NVD page fetch returned no content. No SAP note number, versions or fix found; nothing verified. Do not confuse with CVE-2026-58249 (note 3765424, DoS) or CVE-2026-44756 (note 3747649, EPP, CVSS 10). Revisit once the SAP November patch-day page is live; it would settle note number, WEBDISP versions and fix. Exa search and X not used beyond one search; no discussion found."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}