Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-89119: SAP Web Dispatcher and ICM allow admin actions via malicious link
CVE-2026-89119 · published 1 day ago
Summary
The SAP Web Dispatcher and the Internet Communication Manager in SAP NetWeaver can be tricked into performing admin tasks when a logged‑in administrator clicks a crafted link. An attacker could cause the administrator’s browser to execute unwanted actions, potentially giving the attacker control over the server. Apply the latest SAP patches and ensure administrators use separate browsers or sessions for administrative work.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap_se | sap web dispatcher and internet communication manager | WEBDISP 7.93 |
Original advisory text
Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta