Brief Summary: SAP Web Dispatcher CVE-2026-89126 Heap Buffer Overflow Allowing Unauthenticated Code Execution

Introduction

SAP Web Dispatcher sits at the front of many SAP landscapes, taking HTTP and HTTPS connections before they reach an application server. A heap-based buffer overflow in that component, reachable without authentication and rated CVSS 3.1 10.0 by SAP, means the first network hop into an SAP system could itself become the point of compromise.

SAP describes Web Dispatcher as lying between the Internet and an SAP system. It is the entry point for HTTP and HTTPS requests, accepts or rejects connections, and balances accepted traffic across application servers. According to the affected entries in the CVE record, it is delivered both as a standalone Web Dispatcher and as part of SAP kernel, SAP HANA and XS Advanced packages. SAP SE, founded in 1972, describes itself as a global leader in enterprise applications spanning finance, procurement, human resources, supply chain and customer experience, so a shared edge component like Web Dispatcher touches a wide range of business systems.

SAP fixed CVE-2026-89126 in Security Note 3778556 on the November 10, 2026 Security Patch Day. This post summarizes what the public record establishes, what it leaves out, and how the correction is delivered.

Technical information

Root cause

The CVE record, published by SAP as CNA, states that SAP Web Dispatcher "does not sufficiently validate certain network input processed by an internal component." An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition, and successful exploitation could allow arbitrary code execution and full system compromise.

SAP classifies the weakness as CWE-122, Heap-based Buffer Overflow. MITRE defines this as a buffer overflow where the overwritten buffer is allocated in heap memory, with generic consequences that include crashes, memory modification and arbitrary code execution. The CWE label tells us the bug class. It does not tell us which structure is overwritten, how the heap is laid out, or what exploitation technique applies.

Defenders should also know what has not been disclosed:

• The name of the affected internal component or function
• The network port, URL path or protocol handler involved
• The packet or request layout that triggers the overflow
• Any working exploit procedure

SAP documentation covers Web Dispatcher's normal HTTP and HTTPS role, but the CVE description itself only says "specially crafted network traffic." We therefore do not attribute the flaw to any specific endpoint or protocol path.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• AV:N: exploitable over the network
• AC:L: low attack complexity
• PR:N: no privileges required
• UI:N: no user interaction required
• S:C: impact can cross the vulnerable component's security authority boundary
• C:H / I:H / A:H: high confidentiality, integrity and availability impact

NVD displays SAP's CNA score and had not supplied its own assessment at the time of review. Per the FIRST CVSS v3.1 specification, the changed scope metric describes a security authority boundary; it is not an account of lateral movement observed in a real incident. Base severity is also distinct from exploit maturity.

Attack flow as documented

Based solely on the CVE description and vector, the documented sequence is:

1. An attacker with network reach to a Web Dispatcher instance sends crafted traffic. No credentials and no user interaction are needed.
2. An internal Web Dispatcher component processes that input without sufficient validation.
3. Processing the input corrupts heap memory.
4. Successful exploitation could yield arbitrary code execution and full compromise of the system, with impact potentially extending beyond the Web Dispatcher's own security scope.

These are documented potential outcomes, not evidence of a demonstrated attack against any particular organization. Because Web Dispatcher is designed to be the HTTP and HTTPS entry point, its placement is directly relevant to exposure assessment, though not every affected installation is necessarily reachable from the public Internet.

Exploitation status

As of November 10, 2026, reviewed sources do not confirm active exploitation. StackFlag marks the CVE as not known to be exploited, and TheHackerWire reports no confirmed public exploit code and no known campaign. No threat actor, victim, malware family or indicator set has been attributed to it.

The retrieved CISA Known Exploited Vulnerabilities feed does not list CVE-2026-89126, but that feed is catalog version 2026.11.09, released November 9, 2026, one day before the CVE was published. It cannot tell us anything about later catalog updates. Exploitation is publicly unconfirmed, but it has not been ruled out.

Patch information

Where the fix lives. SAP shipped the fix in SAP Security Note 3778556, released on the November 10, 2026 SAP Security Patch Day. The CVE record lists two references: the note itself and SAP's Security Patch Day portal. SecurityOnline's November 2026 Patch Day roundup lists this CVE among that month's four CVSS 10.0 issues, describing it as memory corruption in SAP Web Dispatcher that can lead to code execution.

What we could and could not verify. The note is only available to signed-in SAP for Me customers. Fetching it without an account returns the SAP sign-in page. As a result, we could not check the exact corrected patch levels, correction instructions or any workaround text in the note. SAP has published no source diff, commit or public changelog, so there is no code to show here. Web Dispatcher is closed-source C/C++ kernel code, and the fix ships as rebuilt binaries.

What the fix has to address. For a CWE-122 overflow triggered by insufficiently validated network input, the fix is almost always a bounds or length check on attacker-controlled input before it is copied into a heap buffer, or a correctly sized allocation, so that the input is rejected or truncated before it corrupts memory. SAP has not said which component or protocol path is involved, so treat this as background on the bug class rather than a description of SAP's actual code change.

Release lines covered. Each affected line needs its own corrected build, and the note maps each line to its fixed patch level:

• Web Dispatcher and kernel 7.53 (WEBDISP 7.53, KRNL64UC 7.53, KERNEL 7.53)
• 7.54, 7.77 and 7.93
• 9.16, 9.18 and 9.20
• Web Dispatcher builds shipped with SAP HANA and XS Advanced (HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1)

Web Dispatcher instances embedded in HANA or XSA landscapes need patching too, not only standalone installs and ABAP kernels.

How the fix is delivered. SAP's Security Notes page splits fixes into Patch Day Security Notes and Support Package Security Notes. For high or very high severity notes, fixes are delivered for Support Packages shipped in the last 24 months, provided the release is still in mainstream or extended maintenance. Since Web Dispatcher is a standalone kernel executable (sapwebdisp), the fix is in practice a binary replacement:

1. Download the corrected Web Dispatcher package (SAPWEBDISP_<PL>.SAR) or kernel patch at or above the level named in Note 3778556 from SAP Software Downloads. SAP's install documentation says this package contains sapwebdisp together with all additional programs and libraries.
2. Unpack it into the Web Dispatcher executable directory, the one set by the instance profile parameter DIR_EXECUTABLE.
3. Restart the instance so the patched binary is loaded.

After the restart, confirm that the running Web Dispatcher reports a patch level at or above the one in the note. Prioritize internet-facing instances, given the unauthenticated, network-reachable vector.

No CVE-specific workaround has been verified in public material. SAP documents URL filtering, HTTP request manipulation and SSL handling as ordinary Web Dispatcher capabilities, but none of these is identified as a mitigation for this memory corruption flaw, and we do not recommend treating them as one.

Affected systems and versions

The CVE record names SAP Web Dispatcher and lists 12 affected version values. We reproduce them exactly, including entries that consist only of a number:

• HDB 2.00
• KRNL64UC 7.53
• WEBDISP 7.53
• 7.54
• 7.77
• 7.93
• 9.16
• XS_ADVANCED_RUNTIME 1.00
• SAP_EXTENDED_APP_SERVICES 1
• KERNEL 7.53
• 9.18
• 9.20

These are affected release entries, not corrected builds, and the record publishes no patch level ranges. To determine whether a given installation is fixed, compare its running patch level against the corrected level mapped in Note 3778556.

Vendor security history

SAP holds Security Patch Day on the second Tuesday of each month and publishes security corrections as Security Notes. Its calendar lists November 10, 2026 for the November release. SAP describes Security Notes as containing security action items and patches, and recommends implementing them as a priority.

A relevant recent case is CVE-2025-31324 in the SAP NetWeaver Visual Composer development server. Canada's Cyber Centre reports that it allowed an unauthenticated actor to upload arbitrary files and had been actively exploited since March 2025. A subsequent correction, CVE-2025-42999, removed residual risk that remained after CVE-2025-31324 was patched. That case shows why the exact applicable correction matters, but it involves a different product and a different mechanism (arbitrary file upload rather than heap memory corruption). It does not establish any attacker activity or patch dependency for CVE-2026-89126.

References

• NVD entry for CVE-2026-89126
• CVE.org record for CVE-2026-89126
• CVE Services API record for CVE-2026-89126
• SAP Security Note 3778556 (SAP for Me login required)
• SAP Security Patch Day portal
• SAP Security Notes and News
• SAP Security Notes delivery policy
• SecurityOnline: SAP Security Patch Day November 2026
• SAP Help: Web Dispatcher installation documentation
• SAP Help: SAP Web Dispatcher overview
• TheHackerWire analysis of CVE-2026-89126
• StackFlag entry for CVE-2026-89126
• CERT FR advisory on multiple SAP vulnerabilities
• Canadian Centre for Cyber Security: SAP NetWeaver vulnerabilities CVE-2025-31324 and CVE-2025-42999
• SAP SE company information
• CISA Known Exploited Vulnerabilities feed
• MITRE CWE 122 definition
• FIRST CVSS v3.1 specification