CVE-2026-89122: Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need to authenticate, but must craft a malicious link and convince a victim to click it. Exploitation depends on user interaction.
What is the likely impact if exploitation succeeds?
Attacker-controlled content can be loaded within the trusted application context. This may enable tracking of user information and defacement of portions of the rendered page, with low confidentiality and integrity impact and no availability impact.
Are unauthenticated users exposed?
Yes. The described attack can be initiated by an unauthenticated attacker, although a victim must click the attacker-crafted link.