CVE-2026-89126: Memory Corruption vulnerability in SAP Web Dispatcher
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the affected functionality by sending specially crafted network traffic. No prior privileges or user interaction are required.
What is the potential impact of successful exploitation?
Successful exploitation could allow arbitrary code execution and full compromise of the SAP Web Dispatcher system. Confidentiality, integrity, and availability may all be affected.
Is a default deployment affected?
The available information does not state whether the vulnerable functionality is enabled or exposed in default SAP Web Dispatcher configurations.
How can I determine whether my system is affected?
The provided information identifies SAP Web Dispatcher as affected but does not include affected version details or detection indicators. Review SAP Note 3778556 for product-specific applicability and remediation guidance.