SAP Web Dispatcher contains a CVSS 10.0 memory corruption flaw. An unauthenticated attacker could exploit it over the network to execute arbitrary code and fully compromise the system.
What Is It
CVE-2026-89126 is a vulnerability in SAP Web Dispatcher. An internal component does not properly validate certain network input. An unauthenticated attacker can send specially crafted network traffic to trigger memory corruption in the affected code. The weakness is classified as CWE-122 (heap-based buffer overflow).
SAP, the CNA, says successful exploitation could let an attacker execute arbitrary code and fully compromise the system. The impact on confidentiality, integrity and availability is high.
At the time of writing, the NVD record has status "Received", so NVD has not yet completed its own analysis.
Why It Matters
SAP gave the flaw the highest possible CVSS v3.1 score, 10.0 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network attack vector: it can be exploited remotely.
- Low attack complexity: no special conditions are needed.
- No privileges or user interaction required: an attacker needs no login and no victim action.
- Changed scope: a compromise can spread beyond the vulnerable component.
SAP Web Dispatcher usually sits at the edge of SAP environments and handles incoming traffic. A pre-authentication code execution flaw in that position deserves urgent attention.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. KEV does not currently confirm active exploitation.
What's Vulnerable
SAP lists these SAP Web Dispatcher versions as affected:
- HDB 2.00
- KRNL64UC 7.53
- WEBDISP 7.53
- KERNEL 7.53
- 7.54
- 7.77
- 7.93
- 9.16
- 9.18
- 9.20
- XS_ADVANCED_RUNTIME 1.00
- SAP_EXTENDED_APP_SERVICES 1
Versions not listed are marked unaffected by default in the CNA data. NVD has published no CPE configurations yet.
Patch Status
The source data does not list fixed versions. SAP points to SAP Security Note 3778556 and its Security Patch Day for remediation details. Administrators running any affected version should review Note 3778556 and apply SAP's fix or guidance as soon as possible.
There is no CISA KEV entry, so no federal required action or due date applies yet.
Sources
- NVD – CVE-2026-89126
- SAP Security Note 3778556
- SAP Security Patch Day
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)