medium · CVSS v3 4.3

CVE-2026-89131

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request for…

Description

SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

Scores

Severity
medium
CVSS v2
5
CVSS v3
4.3
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-109796

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

View analysis

medium

CVE-2026-109801

SAP NetWeaver Application Server Java (NWDI Cockpit) has an authorization bypass that allows low‑privilege users to retrieve sensitive data from other users. This flaw can expose confidential information without affecting integrity or availability. Defenders should ensure the latest patch is applied and review access controls.

View analysis

medium

CVE-2026-109802

SAP NetWeaver Application Server for ABAP contains an input validation flaw that allows authenticated users to send crafted requests, triggering internal errors that crash work processes and cause a denial of service. The flaw does not affect confidentiality or integrity, but it can render the system unavailable. It is a medium‑severity vulnerability with a CVSS score of 6.5.

View analysis

medium

CVE-2026-109805

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.

View analysis