{"id":"CVE-2026-89126","published":"2026-11-10T01:17:22.420","lastModified":"2026-11-11T05:19:55.120","description":"SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3778556","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP Web Dispatcher contains a heap-based buffer overflow (CWE-122) in an internal component due to insufficient validation of network input. An unauthenticated remote attacker can trigger memory corruption by sending specially crafted traffic, potentially leading to arbitrary code execution.","exploitability":"Exploitation is straightforward for a remote attacker with no authentication or user interaction required, as the vulnerability resides in a network-facing component.","blast_radius":"Successful exploitation would allow full system compromise—including remote code execution—with complete loss of confidentiality, integrity, and availability of the affected SAP Web Dispatcher instance and potentially downstream systems.","remediation":"Upgrade to SAP Web Dispatcher version 2.590 or later, as this is the minimum fixed version addressing CVE-2026-89126.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","buffer-overflow","remote-exploit","web","sap"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:41:52.637Z"}}