CVE-2026-89119

CRITICAL 9.6

Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.

Vendor	sap_se
Product	sap web dispatcher and internet communication manager
Published	Nov 10, 2026
Last Updated	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for sap_se sap web dispatcher and internet communication manager

Be the first to know when new critical vulnerabilities affecting sap_se sap web dispatcher and internet communication manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SAP_SE / SAP Web Dispatcher and Internet Communication Manager

WEBDISP 7.93 9.16 XS_ADVANCED_RUNTIME 1.00 KERNEL 7.93 9.20 9.21

References

NVD ↗ CVE.org ↗ EPSS Data ↗

me.sap.com: https://me.sap.com/notes/3804858 url.sap: https://url.sap/sapsecuritypatchday