CRITICAL 9.9 NVD

CVE-2026-89110

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke int

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

References

Published: 2026-10-13 · Source: NVD · Feed updated: 2026-10-13

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-10-13 via NVD.

Risk Timeline

CVE Disclosed2026-10-13 · -1 days ago

Remediation Resources

Official Advisory

url.sap/sapsecuritypatchday

Analysis & PoC

me.sap.com/notes/3797111

vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.