A missing authorization check in SAP NetWeaver Visual Composer (CVSS 9.9, Critical) lets a low-privileged attacker run internal operations on a preconfigured remote system. Depending on how the remote connection is configured, this could lead to full compromise of that system.
What Is It
CVE-2026-89110 is an authorization flaw in SAP NetWeaver Visual Composer. SAP, as the CNA, says the product does not run sufficient authorization checks in certain portal functionality. An attacker with low privileges can use this to invoke internal operations on a preconfigured remote system. The flaw is classified as CWE-749.
The NVD record's status is "Received," so NVD has not yet run its own analysis.
Why It Matters
SAP rates the flaw 9.9 (Critical) under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable: the attack is low complexity.
- Low privileges required: no user interaction is needed.
- Scope changed: the impact reaches past Visual Composer to the connected remote system.
- High impact: confidentiality, integrity and availability are all rated high.
SAP says that, depending on how the remote connection is configured, exploitation "could lead to a full compromise of the remote system." The real risk therefore depends on which remote systems Visual Composer is connected to and how much privilege those connections carry.
Exploitation status: The sources cited here do not report active exploitation, so this brief makes no claim that the flaw is being exploited.
What's Vulnerable
SAP lists one affected product and version:
| Vendor | Product | Affected Version |
|---|---|---|
| SAP SE | SAP NetWeaver Visual Composer | VC70RUNTIME 7.50 |
SAP marks all other versions as unaffected by default. NVD has not yet published any CPE entries.
Patch Status
SAP links this CVE to SAP Note 3797111 and its Security Patch Day page. Administrators running VC70RUNTIME 7.50 should:
- Read SAP Note 3797111 and apply the remediation it describes.
- Check which remote systems are reachable through Visual Composer, since SAP says the impact depends on the remote connection configuration.