CVE-2026-89110

Critical9.9 Published on Oct 13, 2026

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

CVSS score9.9 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-749

Vulnerabilities

SAP Fixes OAuth2 SSRF That Can Expose BTP Application Credentials

SAP fixed an OAuth2 SSRF in Cloud SDK for Python that can expose BTP app credentials via tenant_subdomain. Learn affected versions and upgrade guidance.

Oct 13, 202615:37 2 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2026-89110

Related articles

SAP Fixes OAuth2 SSRF That Can Expose BTP Application Credentials

Audience measurement