Loading vulnerability…
Broken Access Control in SAP NetWeaver Visual Composer
CVE-2026-89110 is an insufficient authorization vulnerability in certain portal functionality of SAP NetWeaver Visual Composer. A low-privileged attacker can invoke internal operations on a preconfigured remote system without adequate authorization checks. Depending on the remote connection configuration, exploitation can fully compromise that remote system. The vulnerability has a CVSS v3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Specific affected versions and vulnerable functions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of a preconfigured remote system, potentially resulting in full system compromise. The extent of the impact depends on the remote connection configuration. The security impact can extend beyond the vulnerable Visual Composer component, as reflected by the changed-scope CVSS assessment.
If you can’t patch tonight, do this now.
No vendor-approved workaround is identified. As interim risk-reduction measures, restrict access to the affected portal functionality and review preconfigured remote connections to minimize their permissions and exposure. These measures do not replace the applicable SAP security update.
Patch, then assume compromise.
Apply the applicable SAP security updates for CVE-2026-89110 following SAP Security Note 3797111 and the October 13, 2026 Security Patch Day guidance. Specific affected versions, fixed releases, and patch installation details are not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.