CVE-2026-89125: Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager
Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of credentials across users and deployments, potentially leading to credential exposure and unauthorized access. Successful exploitation could expose credentials and facilitate unauthorized access to affected systems, resulting in a high impact on confidentiality and a low impact on integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrative privileges on an affected SAP Web Dispatcher or SAP Internet Communication Manager instance. The issue is therefore most relevant where administrative access has already been granted, compromised, or insufficiently restricted.
What is the likely impact if exploitation succeeds?
Stored sensitive information, including credentials, may be exposed. The disclosed data could be correlated across users and deployments, enabling unauthorized access to affected systems.
How can we determine whether we are affected?
Review whether SAP Web Dispatcher or SAP Internet Communication Manager is deployed in your environment and consult SAP Note 3782056 for affected-product and remediation details. The provided information does not identify specific affected versions or configurations.