CVE-2026-89120— Missing authorization check in SAP ABAP Platform
Quick assessment
Affected
SAP_SE SAP ABAP Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
由 SAP ABAP 平台 API 变更引发的回归漏洞，重新引入了之前已修复的授权弱点。会话管理器可以在单事务模式下打开，包括从 FLP（Launchpad）中启动。低权限攻击者可通过特制请求绕过限制，导致完整性方面的高影响，以及保密性方面的低影响。该漏洞对可用性无影响。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1136 · Create AccountAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP ABAP Platform | KERNEL 7.93 |
affected |
9.16 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89120
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing authorization check in SAP ABAP Platform
Source: CVE Program / CVE List V5
Vulnerability Description
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的默认资源初始化
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP ABAP Platform | KERNEL 7.93 | - |
|
II. Public POCs for CVE-2026-89120
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89120
请登录查看更多情报信息。
Vendor Pages for CVE-2026-89120 (1)
Same Patch Batch · SAP_SE · 2026-10-13 · 20 CVEs total
| CVE-2026-89111 | 10.0 CRITICAL | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python |
| CVE-2026-89107 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) |
| CVE-2026-89110 | 9.9 CRITICAL | Broken Access Control in SAP NetWeaver Visual Composer |
| CVE-2026-89108 | 9.1 CRITICAL | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati |
| CVE-2026-89113 | 8.8 HIGH | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) |
| CVE-2026-58249 | 7.5 HIGH | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communic |
| CVE-2026-89112 | 6.5 MEDIUM | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure |
| CVE-2026-76972 | 6.5 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence |
| CVE-2026-89122 | 6.1 MEDIUM | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89117 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-76975 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) |
| CVE-2026-89116 | 5.9 MEDIUM | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code |
| CVE-2026-76976 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applica |
| CVE-2026-89118 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89121 | 4.7 MEDIUM | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) |
| CVE-2026-89106 | 4.4 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAPUI5 |
| CVE-2026-89124 | 4.3 MEDIUM | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Pr |
| CVE-2026-89105 | 4.2 MEDIUM | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra |
| CVE-2026-58242 | 3.5 LOW | Improper Authorization check in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89124
Missing Authorization Check in SAP Global Trade Services, ed -
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Man -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp -
CVE-2026-89117
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En
Same weakness: CWE-1188
-
CVE-2026-110631
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via -
CVE-2026-14765
Epic Games Unreal Engine Insecure Default URL Scheme Allowan -
CVE-2026-89105
Improper Authentication in HybridTokenAuthenticator of SAP/c -
CVE-2026-109569
sandboxed.sh through 1.3.0 Container Escape via nsenter Miss -
CVE-2026-78018
Dell SCG<5.34.00.16初始化资源不当致信息泄露
V. Comments for CVE-2026-89120
No comments yet