Brief Summary: CVE-2026-89119, Administrative CSRF in SAP Web Dispatcher and NetWeaver ICM

Introduction

A single click by a logged-on SAP administrator on an attacker-supplied link could be enough to drive unintended administrative actions in SAP Web Dispatcher or the NetWeaver ABAP Internet Communication Manager (ICM), and SAP states the end result could be full compromise of the underlying operating system. Because Web Dispatcher often sits at the HTTP(S) entry point in front of SAP application servers, CVE-2026-89119 deserves attention even though it depends on administrator interaction and no exploitation has been publicly reported.

SAP rates the issue CVSS 3.1 9.6 (Critical) and addresses it in SAP Security Note 3804858. In this short review we summarize what the public record says, what it does not say, and how the issue relates to SAP's recent security history.

Technical information

Root cause: CSRF in administrative functionality

The vulnerability is classified as CWE-352, Cross Site Request Forgery (CSRF). SAP's description states that SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (ICM) "do not perform sufficient request validation in certain administrative functionality." SAP does not name a specific endpoint or parameter.

The general CSRF mechanism, as described by OWASP, explains why this matters:

A browser automatically attaches credentials associated with a site, such as session cookies, to requests sent to that site, including requests initiated from a different origin.
If the target application does not adequately validate that a state-changing request was intentionally issued by the user (for example through a CSRF token or origin validation), it treats the forged request as an authorized action.
The impact is bounded by the victim's privileges. Here the victim is an administrator, which is why the potential impact is so high.

The attacker needs no account on the SAP system. The attack relies instead on the victim's authentication: an administrator who is already logged on.

Attack flow

Based on SAP's published description, the documented scenario (not an observed intrusion) is:

An administrator is logged on to the administrative functionality of an affected SAP Web Dispatcher or AS ABAP ICM instance.
An unauthenticated attacker tricks that administrator into visiting a malicious link.
The administrator's browser issues a request to the SAP component that carries the administrator's existing session.
Due to insufficient request validation, the component performs unintended actions in the administrator's session.
SAP states that successful exploitation could lead to full compromise of the underlying operating system, with high impact on confidentiality, integrity, and availability.

The public description does not disclose the intermediate administrative actions that turn session misuse into operating system compromise.

CVSS breakdown

The published vector, supplied by SAP SE as CNA (NVD had not provided an independent NIST assessment at the time of review), is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

UI:R captures the dependency on an administrator visiting the link. S:C reflects that the impact extends beyond the vulnerable component to the underlying operating system.

Why existing protections may not help

An administrative interface can require login and use HTTPS and still be exposed to CSRF. OWASP notes that HTTPS alone does not prevent CSRF, that SameSite cookies usually do not replace CSRF protection (SameSite=Lax still sends cookies on certain cross-site top-level navigations, so state-changing GET endpoints remain exposed), and that merely requiring POST is insufficient. The SAP scenario abuses a session that is already authenticated, so password protection and transport encryption address different parts of the attack surface.

SAP's Web Dispatcher documentation recommends restricting administrative ports to internal networks, limiting administrative hosts and clients, permitting administration only over HTTPS, and deactivating unauthenticated public monitoring information in the Web Admin interface. These are general hardening measures and are not confirmed substitutes for the correction in Note 3804858.

What remains unpublished

The reviewed public sources do not identify the vulnerable administrative route, HTTP method, parameter, payload, or the exact action sequence leading to OS compromise. Note 3804858 requires an SAP for Me sign-in, so its correction instructions, prerequisites, and any workaround could not be reviewed from public text.

Affected systems and versions

The CVE record identifies the vendor as SAP_SE and the product as SAP Web Dispatcher and Internet Communication Manager. The affected version entries are reproduced verbatim:

Version entry	Status
WEBDISP 7.93	Affected
9.16	Affected
XS_ADVANCED_RUNTIME 1.00	Affected
KERNEL 7.93	Affected
9.20	Affected
9.21	Affected

Notes for inventory work:

The record's default status is unaffected, but the record lists no fixed builds, so these labels do not establish which patch level within an affected release contains the correction.
XS_ADVANCED_RUNTIME 1.00 appears in the list, so scoping should cover the full vendor list rather than only the headline products.
The vulnerable surface is the administrative functionality, not every request the dispatcher handles. Instances where administrators actively use the administrative interface from a browser are the relevant configuration.
Applicability for a given component and patch level should be confirmed through SAP Security Note 3804858.

Vendor security history

The input data lists the vendor as unknown, but the NVD and CVE records confirm it is SAP SE, which also acted as CNA. SAP's Product Security Response Team handles validation, impact assessment, and remediation coordination, and publishes corrections on Security Patch Day, the second Tuesday of each month.

The most relevant recent precedent is the 2025 NetWeaver Visual Composer case:

April 24, 2025: SAP released an emergency update for CVE-2025-31324, an unauthenticated arbitrary file upload in the Visual Composer development server. Canada's Cyber Centre reported awareness of exploitation dating to March 2025.
April 29, 2025: CISA added CVE-2025-31324 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
May 13, 2025: SAP addressed CVE-2025-42999, which the Cyber Centre states removes residual risk remaining after patching CVE-2025-31324.
EclecticIQ linked CVE-2025-31324 intrusions to UNC5221, UNC5174 and CL-STA-0048, with a high-confidence assessment of China-nexus APT involvement.

That case concerns different vulnerabilities and a different affected function. It is useful context for following subsequent SAP security communications, but it does not establish exploitation, actors, indicators, or patch incompleteness for CVE-2026-89119. For this CVE, StackFlag lists it as not known to be exploited, and TheHackerWire reports no confirmed public exploit code and no current CISA KEV listing.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information