Brief Summary: SAP Gateway CVE-2026-89103, a Default ACL Broken Access Control Flaw Scored CVSS 10.0

Introduction

SAP's November 2026 Security Patch Day included a correction for a flaw in SAP Gateway that lets an unauthenticated network peer be treated as one of the system's own application servers. The Gateway's default Access Control List extends its trust to exactly that internal category, so the misclassification carries a CNA-assigned CVSS 3.1 score of 10.0, with potential high impact on confidentiality, integrity, and availability across the application environment.

In this post we summarize what the public record says about CVE-2026-89103, where the fix lands, and which details remain locked behind SAP's customer portal.

Technical information

Root cause: trust confusion in the default ACL

SAP describes the issue as follows: the Gateway "activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server." The CVE title is Broken Access Control in SAP Gateway, and the weakness is classified as CWE 863, Incorrect Authorization. The Gateway does make an authorization decision, so the check itself is present. The flaw is in how that decision is made, specifically in whether a remote peer is classified as internal.

How the Gateway default ACL works

SAP Gateway uses access control lists to decide three things:

• who may register RFC server programs (reginfo)
• who may start external programs (secinfo)
• who may relay traffic to other gateways (prxyinfo)

If an administrator has not maintained those files, the Gateway falls back to built-in default rules controlled by the profile parameter gw/acl_mode. With the following setting, SAP's documentation states that external and registered servers are permitted only from application servers of the same system, and everything else is rejected:

gw/acl_mode = 1

The generated default rules depend on the internal and local host keywords. The default reginfo rule is:

P TP=* HOST=internal,local ACCESS=internal,local CANCEL=internal,local

The default prxyinfo rule is:

P SOURCE=internal DEST=*

SAP's RFC Gateway documentation explains that the host value internal applies to hosts in the SAP system, and that the Gateway internally replaces it with the list of application servers in that system.

Why misclassification is so consequential

In the default configuration, the internal keyword is effectively the trust boundary of the whole ACL. If the Gateway places a remote, unauthenticated host into that category, every default rule that permits internal permits the attacker too. That explains the severity. An access control model that is sound in design becomes permissive because its input, the classification of the peer, is wrong.

The public description does not state whether systems with fully maintained reginfo, secinfo, and prxyinfo files are affected in the same way. It points specifically at the default ACL activation path.

Attack flow

Based on the published description, the exploitation sequence is:

1. The attacker has network access to an affected SAP Gateway. No credentials and no user interaction are required.
2. The Gateway, operating with its default high-privilege ACL, categorizes the external attacker as an internal application server.
3. The attacker can then potentially perform unauthorized actions within the application environment that the default rules grant to internal hosts.

The available material does not specify the request format, transport port, packet fields, commands, or the exact operations that become available. It therefore does not establish a particular remote code execution technique or a reproducible attack procedure, and we do not speculate on one here.

CVSS assessment

SAP, as CNA, published this vector. NVD displays it and states that its own assessment is not yet provided:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: None
• Scope: Changed
• Confidentiality, Integrity, Availability: High

These values describe potential impact, not observed attacker activity.

Exploitation status

The official CVE and NVD records do not name a threat actor, victim, campaign, or incident. StackFlag reports that the vulnerability is not known to be exploited, while labeling automatic exploitation and full attacker control as estimates. TheHackerWire reports no detected or confirmed public proof of concept, no known linked ransomware campaign, and absence from the CISA Known Exploited Vulnerabilities catalog. That KEV status is the tracker's report, and we have not verified it directly against the catalog. No CVE-specific indicators of compromise have been published.

Patch information

SAP released the fix as SAP Security Note 3798345, shipped on the November 10, 2026 SAP Security Patch Day. The CVE record SAP filed as CNA lists only two references: that note and SAP's Patch Day landing page. There is no public commit, diff, or open-source advisory. The note requires an SAP for Me (S user) login, so the exact correction, the fixed patch levels, and any manual follow-up steps cannot be checked in public sources. Public trackers such as OffSeq still leave the Fixed in column empty for the affected builds.

The fix lands in the kernel, not ABAP

The affected product list contains only SAP kernel lines, and no SAP_BASIS support package range is listed. The correction is therefore a gateway and kernel executable patch for each kernel line, not an ABAP correction instruction that the Note Assistant (SNOTE) can apply. Teams should plan it as a kernel exchange, restart included, on every instance that runs a gateway. Standalone RFC gateways need it too, not just ABAP application servers.

What we can and cannot say about the code change

The precise change is not public. The advisory text points at how the Gateway decides that a peer is internal when it builds or applies the default ACL. A fix would most likely tighten that classification or drop the overly privileged default rules, but this is an inference from the advisory text, not something we have confirmed. No code from a public source is available, so none is shown. Customers should read Note 3798345 directly for:

• the minimum kernel patch level for each release line
• any accompanying profile parameter guidance, for example around gw/acl_mode
• prerequisite or side-effect notes

Gateway hardening is complementary, not a workaround

SAP documents several Gateway security controls. None of them is verified as a substitute for the correction:

• gw/acl_file configures who may connect to the Gateway. SAP states that an absent or erroneously specified ACL file causes the Gateway to close immediately.
• secinfo, located through gw/sec_info, prevents unauthorized launching of external programs.
• reginfo, located through gw/reg_info, controls registration of external programs. SAP notes that previously registered servers keep their old attributes after the file is modified and reactivated. They must be deregistered and registered again for updated settings to apply.
• gw/acl_mode defines behavior when the security files do not exist. SAP says value 0 leaves external server starting and registration unrestricted and should not be used in production. Value 1 permits servers within the system, which is exactly the internal classification this CVE undermines, so it should not be treated as a fix.

Affected systems and versions

The CVE record lists 12 affected version entries. We reproduce the labels as published rather than inferring additional product mappings:

• KRNL64NUC 7.22
• 7.22EXT
• KRNL64UC 7.22
• KERNEL 7.22
• 7.53
• 7.54
• 7.77
• 7.93
• 8.04
• 9.16
• 9.20
• 9.21

Grouped by kernel line, that is KERNEL, KRNL64NUC, and KRNL64UC 7.22 and 7.22EXT; 7.53, 7.54, 7.77, 7.93; 8.04; and 9.16, 9.20, 9.21. The public record does not provide a corrected patch level for any of these entries, and the list should not be expanded into a claim that every SAP product or kernel build is affected.

The relevant exposure condition is an affected Gateway reachable over the network by the attacker, operating with the default ACL behavior described by SAP. NVD lists November 10, 2026 as its publication date, and the CVE record was published on November 10, 2026 at 00:18:43 UTC.

Vendor security history

SAP SE is the vendor and CNA. SAP describes a secure development and operations lifecycle including risk, privacy, and ethics assessments, threat modeling, secure programming and code review guidance, bug bounty programs, external infrastructure scans, independent penetration tests, red team testing, and a security operations center running around the clock. It publishes monthly fixes on Security Patch Day and distributes Security Notes through SAP for Me.

The reviewed material does not establish prior CVE counts, when SAP learned of this issue, or how long remediation took, so we make no claim about its overall track record. SAP's shared responsibility model assigns configuration to customers, but this issue concerns default Gateway behavior and the record does not attribute it to customer error.

References

• NVD entry for CVE 2026 89103
• CVE.org record for CVE 2026 89103
• CVE Services API record
• SAP Security Note 3798345 (SAP for Me login required)
• SAP Security Patch Day
• ThreatInt CVE entry
• SecurityOnline: SAP Security Patch Day November 2026
• OffSeq Radar entry
• SAP Help: Gateway Security Parameters (NW 7.5)
• SAP Help: Gateway Security Parameters (SCM 7.0)
• SAP Help: RFC Gateway Security Files secinfo and reginfo
• SAP Blogs: RFC Gateway Security Part 2, reginfo ACL
• SAP Community: RFC Gateway Security Part 4, prxyinfo ACL
• TheHackerWire analysis
• StackFlag analysis
• SAP: Report a Security Issue
• SAP: Company Information
• SAP Trust Center: Security