Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-89119 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | SAP |
| Product | Web Dispatcher |
| Vulnerability Type | Cross-Site Request Forgery (CSRF) (CWE-352) |
| SAP Note | 3804858 |
| CVSS Score | 9.6 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, SAP
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator’s session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
The flaw was published as part of the November 2026 SAP Security Patch Day. The attack requires no authentication but needs action by a logged-on administrator.
Required Actions
- Apply the fix from SAP Note 3804858 (SAP Security Patch Day, November 2026) to both SAP Web Dispatcher and the ICM of ABAP systems.
- Restrict access to the Web Dispatcher and ICM administrative interfaces to the administrative network.
- Remind SAP administrators not to open links from untrusted sources while logged on to an administrative session.
Who Is Affected?
This vulnerability affects SAP Web Dispatcher. NVD provides no CPE configuration; affected versions and support packages are listed in SAP Note 3804858 (requires an SAP for Me account). SAP systems are mainly used by mid-sized and large enterprises (ERP, S/4HANA, NetWeaver platforms), so also check systems operated by partners and service providers.
The same Patch Day covered eight other critical SAP flaws: CVE-2026-109795, CVE-2026-109798, CVE-2026-109803, CVE-2026-120017, CVE-2026-76964, CVE-2026-76965, CVE-2026-89103, CVE-2026-89126.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-89119 vulnerability?
CVE-2026-89119 is a vulnerability in SAP Web Dispatcher — Cross-Site Request Forgery (CSRF) — rated CVSS 9.6 (critical severity). SAP released a fix in Note 3804858 as part of the November 2026 SAP Security Patch Day.
Does exploiting CVE-2026-89119 require authentication?
According to the vendor's CVSS assessment, the attack requires no authentication but needs action by a logged-on administrator. The attack is carried out over the network.
How to protect against CVE-2026-89119?
Apply the fix from SAP Note 3804858 and, until it is deployed, restrict network access to the affected component. The note lists affected versions and any available workarounds.
Who is affected by CVE-2026-89119?
It affects organizations running SAP Web Dispatcher, typically mid-sized and large enterprises with SAP ERP or S/4HANA and the related NetWeaver components.
