---
id: "CVE-2026-89126"
page: "https://infrastack.ai/live/CVE-2026-89126"
kind: "vulnerability"
aliases: ["CVE-2026-89126"]
title: "SAP Web Dispatcher: unvalidated network input lets unauthenticated attackers run code"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "sap", "sap-web-dispatcher", "self-hosted"]
not_affected_if: ["no-web-dispatcher"]
published_at: "2026-11-10T01:17:22+00:00"
first_seen_at: "2026-11-10T01:26:44+00:00"
updated_at: "2026-11-10T01:29:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89126", "first_seen_at": "2026-11-10T01:26:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T01:29:16+00:00"}]
exploit_sources: []
---

# SAP Web Dispatcher: unvalidated network input lets unauthenticated attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-89126 (this .md is for agents)

SAP Web Dispatcher fails to validate certain network input handled by an internal component, causing memory corruption. An unauthenticated attacker sending crafted traffic could execute arbitrary code and fully compromise the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify SAP Web Dispatcher instances in your environment and record their release and patch level.
- Compare the installed patch level against the SAP security note for this CVE (unknown from the sources).

## Timeline

- 2026-11-10T01:26:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89126
- 2026-11-10T01:29:16+00:00 analyst — Could not find CVE-2026-89126 on SAP's own Sep or Oct 2026 patch-day pages (checked in full). The Nov 2026 page returned 404 on 2026-11-10, patch day itself, so it may not be published yet. NVD page fetch returned no content. No SAP note number, versions or fix found; nothing verified. Do not confuse with CVE-2026-58249 (note 3765424, DoS) or CVE-2026-44756 (note 3747649, EPP, CVSS 10). Revisit once the SAP November patch-day page is live; it would settle note number, WEBDISP versions and fix. Exa search and X not used beyond one search; no discussion found.

## From the sources

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_