CVE-2026-89110 — Broken Access Control in SAP NetWeaver Visual Composer
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations …
Published: 2026-10-13 · CVSS: 9.9 · CVSS 3.1
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7