CVE-2026-89126— Memory Corruption vulnerability in SAP Web Dispatcher
Quick assessment
Affected
SAP_SE SAP Web Dispatcher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Web Dispatcher 对其内部组件处理的某些网络输入未进行充分验证。未经身份验证的攻击者可以发送特制的网络流量，触发受影响功能中的内存损坏漏洞。若该漏洞被成功利用，攻击者可能执行任意代码并完全控制受影响的系统，从而对系统的机密性、完整性和可用性造成严重影响。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89126
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Memory Corruption vulnerability in SAP Web Dispatcher
Source: CVE Program / CVE List V5
Vulnerability Description
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Web Dispatcher | HDB 2.00 | - |
|
II. Public POCs for CVE-2026-89126
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89126
请登录查看更多情报信息。
Other References for CVE-2026-89126 (1)
Same Patch Batch · SAP_SE · 2026-11-10 · 40 CVEs total
| CVE-2026-76964 | 10.0 CRITICAL | Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) |
| CVE-2026-120017 | 10.0 CRITICAL | Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) |
| CVE-2026-89103 | 10.0 CRITICAL | Broken Access Control in SAP Gateway |
| CVE-2026-109795 | 9.9 CRITICAL | Missing authorization check in S4CRM |
| CVE-2026-76965 | 9.9 CRITICAL | OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP P |
| CVE-2026-109803 | 9.9 CRITICAL | Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) |
| CVE-2026-89119 | 9.6 CRITICAL | Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi |
| CVE-2026-109798 | 9.1 CRITICAL | XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platf |
| CVE-2026-76966 | 8.9 HIGH | Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform |
| CVE-2026-120008 | 8.2 HIGH | Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service) |
| CVE-2026-109800 | 7.7 HIGH | Memory Corruption vulnerability in SAP Web Dispatcher |
| CVE-2026-120014 | 7.6 HIGH | Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi |
| CVE-2026-76973 | 7.5 HIGH | Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platf |
| CVE-2026-109794 | 7.5 HIGH | Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform an |
| CVE-2026-109793 | 7.5 HIGH | Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet C |
| CVE-2026-109804 | 7.5 HIGH | Information Disclosure in SAP NetWeaver (SAP Message Server) |
| CVE-2026-109806 | 7.5 HIGH | Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) |
| CVE-2026-109807 | 7.5 HIGH | Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) |
| CVE-2026-89114 | 7.5 HIGH | Missing Authentication check in SAP NetWeaver AS Java EDM Application |
| CVE-2026-76970 | 7.5 HIGH | Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Plat |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: SAP Web Dispatcher
-
CVE-2026-109800
Memory Corruption vulnerability in SAP Web Dispatcher -
CVE-2024-47590
Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatch -
CVE-2023-35871
Memory Corruption vulnerability in SAP Web Dispatcher -
CVE-2023-33987
Request smuggling and request concatenation in SAP Web Dispa -
CVE-2021-38162
SAP Web dispatcher 环境问题漏洞
Same vendor: SAP_SE
-
CVE-2026-109799
Improper verification of JWT signature in IASContextProvider -
CVE-2026-109797
Cross-tenant sandbox takeover in SAP/astonish -
CVE-2026-109805
Weak Cryptography in SAP NetWeaver and ABAP Platform (Applic -
CVE-2026-89125
Insecure Storage of Sensitive Information in SAP Web Dispatc -
CVE-2026-120017
Missing Authentication in SAP NetWeaver AS ABAP and ABAP Pla
Same weakness: CWE-122
-
CVE-2026-91760
Heap-based Buffer Overflow Vulnerability in Hitachi Dynamic -
CVE-2026-125401
Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu -
CVE-2026-125393
MailEnable Enterprise Premium before 10.62 Heap Overflow via -
CVE-2026-125260
FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE -
CVE-2026-125250
FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via sh