{"id":"CVE-2026-89110","published":"2026-10-13T01:16:47.767","lastModified":"2026-10-15T20:38:04.303","description":"SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-749"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3797111","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP NetWeaver Visual Composer lacks proper authorization checks, allowing low-privilege attackers to invoke internal operations on remote systems. This can lead to full system compromise depending on remote connection configuration.","exploitability":"Exploitation requires a low-privilege user account with access to the affected portal functionality, and is relatively straightforward once the vulnerability is identified.","blast_radius":"The impact could be extensive as attackers may gain full control over remote systems, potentially leading to data breaches, system manipulation, and service disruption across the organization's SAP infrastructure.","remediation":"Apply the latest SAP Note 3215900 which contains the fix for this vulnerability in SAP NetWeaver Visual Composer.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sap","authorization","remote"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:47:00.844Z"}}