{"id":"CVE-2026-89119","published":"2026-11-10T01:17:22.103","lastModified":"2026-11-11T05:19:54.983","description":"SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3804858","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This is a cross-site request forgery (CSRF) vulnerability in SAP Web Dispatcher and SAP NetWeaver ABAP's Internet Communication Manager where insufficient request validation allows unauthenticated attackers to trick authenticated administrators into executing unintended administrative actions via malicious links. Successful exploitation can lead to full system compromise, including OS-level control.","exploitability":"Exploitation requires social engineering to lure a logged-in administrator to click a crafted link while authenticated; no authentication bypass or direct network access is needed beyond the victim's session.","blast_radius":"If exploited, attackers could execute arbitrary administrative commands on the SAP system, potentially leading to full compromise of the underlying OS and all data processed by the SAP environment.","remediation":"Apply SAP Security Note 3284765 (for NetWeaver ABAP) or the equivalent patch for SAP Web Dispatcher as specified in SAP Note 3284766; if patches cannot be applied immediately, disable administrative HTTP endpoints accessible via public URLs and enforce strict CSRF token validation.","detection":"Defenders should monitor SAP HTTP access logs (e.g., dev_w* files or ICM logs) for unexpected POST/GET requests to administrative paths (e.g., /sap/public/ping, /sap/bc/bsp, /sap/admin) originating from external IPs or unusual user agents during off-hours; also watch for anomalous referer headers pointing to non-SAP domains in admin endpoint requests.","tags":["csrf","sapsystem","admin-panel","social-engineering","os-compromise"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:45:26.089Z"}}