Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-89126: SAP Web Dispatcher can be taken over by crafted traffic
CVE-2026-89126 · published 1 day ago
Summary
The SAP Web Dispatcher component can be tricked by specially crafted network data into corrupting its memory. An attacker who does not need any login could then run their own code on the server, putting the whole system at risk. Install the vendor's security update as soon as possible and restrict network access to the dispatcher to only trusted sources.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap_se | sap web dispatcher | HDB 2.00 |
Original advisory text
Memory Corruption vulnerability in SAP Web Dispatcher
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta