CVE-2026-89103 is a CVSS 10.0 authorization flaw in SAP Gateway: a default Access Control List with high privileges can lead the gateway to treat an external attacker as an internal application server.
What Is It
CVE-2026-89103 is an incorrect authorization weakness (CWE-863) in SAP Gateway. SAP is the CVE Numbering Authority. According to its description, SAP Gateway turns on a default Access Control List with high privileges. That ACL can classify an external attacker as an internal application server. An unauthenticated attacker with network access to the SAP Gateway could use this to potentially perform unauthorized actions within the application environment.
The record is listed in NVD with the status "Received," which means NVD has not yet completed its own analysis.
Why It Matters
SAP rates this flaw at the maximum CVSS 3.1 score of 10.0 (CRITICAL). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable, with low attack complexity
- No privileges and no user interaction required
- Scope changed: the impact can reach beyond the vulnerable component
- High impact on confidentiality, integrity and availability
An attacker who only needs network access to the gateway, and no credentials, to be trusted as an internal server is a serious exposure for SAP environments.
Exploitation status: CVE-2026-89103 is not in the CISA Known Exploited Vulnerabilities catalog. The supplied KEV data does not confirm active exploitation, and CISA has not issued a required action or due date.
What's Vulnerable
SAP lists SAP Gateway (vendor SAP_SE) as affected in these versions:
- KERNEL 7.22
- KRNL64NUC 7.22
- KRNL64UC 7.22
- 7.22EXT
- 7.53
- 7.54
- 7.77
- 7.93
- 8.04
- 9.16
- 9.20
- 9.21
Versions not on this list are marked unaffected by default. The NVD record does not yet include any CPE entries.
Patch Status
SAP's advisory references are SAP Security Note 3798345 and the SAP Security Patch Day page. Neither the NVD record nor CISA describes fixed versions or specific workarounds. Administrators should read SAP Note 3798345 for SAP's remediation guidance and apply it to the affected SAP Gateway kernel versions. Given the CVSS 10.0 rating and the lack of any authentication requirement, this should be a high priority. Until it is fixed, check which systems can reach SAP Gateway over the network.
Sources
- SAP Security Note 3798345
- SAP Security Patch Day
- NVD: CVE-2026-89103
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-89103 not listed)