by Kastro
Paper/Archive/CVE-2026-89126

CVE-2026-89126

SAP_SE SAP Web Dispatcher — Memory Corruption vulnerability in SAP Web Dispatcher

CVSS 10.0
critical.is priorityof 100
30
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Affected

ProductAffectedFixed inSource
SAP Web DispatcherHDB 2.00–CNA
SAP Web DispatcherKRNL64UC 7.53–CNA
SAP Web DispatcherWEBDISP 7.53–CNA
SAP Web Dispatcher7.54–CNA
SAP Web Dispatcher7.77–CNA
SAP Web Dispatcher7.93–CNA
SAP Web Dispatcher9.16–CNA
SAP Web DispatcherXS_ADVANCED_RUNTIME 1.00–CNA
SAP Web DispatcherSAP_EXTENDED_APP_SERVICES 1–CNA
SAP Web DispatcherKERNEL 7.53–CNA
SAP Web Dispatcher9.18–CNA
SAP Web Dispatcher9.20–CNA

Scores by source

sap (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refme.sap.com/notes/3778556refurl.sap/sapsecuritypatchday