CVE-2026-89110: Broken Access Control in SAP NetWeaver Visual Composer
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments of SAP NetWeaver Visual Composer with the affected portal functionality and a preconfigured remote system connection are exposed. Exploitation requires an attacker to have low-privileged access.
What access and conditions does an attacker need?
The attacker needs low privileges and network access to invoke the relevant portal functionality. The potential impact depends on the configuration of the preconfigured remote connection.
Does successful exploitation compromise only Visual Composer?
No. The attacker may be able to invoke internal operations on a connected remote system, and the issue can lead to full compromise of that remote system depending on its connection configuration.