Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SAP Gateway lets external users act as internal server

CVE-2026-89103 · published 1 day ago
Summary

SAP Gateway’s default settings mistakenly treat anyone on the network as a trusted internal application server. This can let an outsider who reaches the gateway perform actions they shouldn’t, potentially exposing or damaging data and services. Update the access control configuration to require proper authentication and limit permissions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap_se sap gateway KRNL64NUC 7.22
Original advisory text
Broken Access Control in SAP Gateway
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-89103 · NVD
CVE-2026-89103 · MITRE
Track software like this
Free during beta