Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-89103 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | SAP |
| Product | Gateway |
| Vulnerability Type | incorrect authorization (default ACL) (CWE-863) |
| SAP Note | 3798345 |
| CVSS Score | 10.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, SAP
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
The flaw was published as part of the November 2026 SAP Security Patch Day. The attack requires no authentication.
Required Actions
- Apply the fix from SAP Note 3798345 (SAP Security Patch Day, November 2026) as a priority, since the flaw requires no authentication.
- Verify that SAP Gateway uses explicitly defined access control lists (secinfo and reginfo files) rather than default rules.
- Restrict network access to SAP Gateway ports to the application servers and systems that actually communicate with it.
Who Is Affected?
This vulnerability affects SAP Gateway. NVD provides no CPE configuration; affected versions and support packages are listed in SAP Note 3798345 (requires an SAP for Me account). SAP systems are mainly used by mid-sized and large enterprises (ERP, S/4HANA, NetWeaver platforms), so also check systems operated by partners and service providers.
The same Patch Day covered eight other critical SAP flaws: CVE-2026-109795, CVE-2026-109798, CVE-2026-109803, CVE-2026-120017, CVE-2026-76964, CVE-2026-76965, CVE-2026-89119, CVE-2026-89126.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-89103 vulnerability?
CVE-2026-89103 is a vulnerability in SAP Gateway — incorrect authorization (default ACL) — rated CVSS 10 (critical severity). SAP released a fix in Note 3798345 as part of the November 2026 SAP Security Patch Day.
Does exploiting CVE-2026-89103 require authentication?
According to the vendor's CVSS assessment, the attack requires no authentication. The attack is carried out over the network.
How to protect against CVE-2026-89103?
Apply the fix from SAP Note 3798345 and, until it is deployed, restrict network access to the affected component. The note lists affected versions and any available workarounds.
Who is affected by CVE-2026-89103?
It affects organizations running SAP Gateway, typically mid-sized and large enterprises with SAP ERP or S/4HANA and the related NetWeaver components.
