CVE-2026-89131: Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using SAP NetWeaver Enterprise Portal are exposed when authenticated users can be induced to click an attacker-controlled malicious link. The attacker does not need to authenticate, but exploitation depends on a victim having an active authenticated session.
What can an attacker do if exploitation succeeds?
Successful exploitation can trigger an unintended server-side action and modify non-sensitive information. The reported impact is limited to integrity; no confidentiality or availability impact is described.
Does exploitation require user interaction?
Yes. An authenticated user must click the malicious link crafted by the attacker. The vulnerability is remotely exploitable and has low attack complexity, with no attacker privileges required.