An unauthenticated attacker could trick a logged-in administrator into clicking a malicious link and use their session to compromise the underlying operating system. SAP rates the flaw CVSS 9.6 (Critical) in SAP Web Dispatcher and the SAP NetWeaver Application Server ABAP Internet Communication Manager (ICM).
What Is It
CVE-2026-89119 is a cross-site request forgery (CSRF) flaw (CWE-352) in certain administrative functions of SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (ICM). These functions do not check incoming requests well enough. An attacker who needs no login can craft a malicious link, and if a logged-in administrator visits it, the request carries out unintended actions in the administrator's session.
SAP, the CNA, scored it CVSS 3.1 9.6 (Critical), vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The NVD record's status is "Received," so NVD has not yet run its own analysis.
Why It Matters
According to SAP, a successful attack could fully compromise the underlying operating system, with high impact on confidentiality, integrity, and availability. The scope is marked "Changed," which means the damage reaches beyond the vulnerable component. The attack works over the network, has low complexity, and needs no privileges. Its one requirement is getting an administrator to click a link. Web Dispatcher and ICM handle HTTP traffic in SAP environments, so they are often reachable by users and sometimes from the internet.
KEV status: This CVE has no CISA Known Exploited Vulnerabilities entry in the supplied data, so active exploitation is not confirmed.
What's Vulnerable
The CNA lists the product as "SAP Web Dispatcher and Internet Communication Manager." These versions are marked affected:
- WEBDISP 7.93
- KERNEL 7.93
- XS_ADVANCED_RUNTIME 1.00
- 9.16
- 9.20
- 9.21
The source data does not name the component for versions 9.16, 9.20, and 9.21. The NVD record lists no CPEs.
Patch Status
SAP points to SAP Security Note 3804858 and its Security Patch Day page. The supplied data does not list fixed versions or specific workarounds. Administrators should read SAP Note 3804858 (an SAP login is required) and apply the fix it describes. Until patched systems are confirmed, it helps to limit who can reach the Web Dispatcher and ICM admin interfaces. Administrators should also avoid clicking untrusted links while logged in to them.