CVE-2026-89126
Received Received - Intake

Memory Corruption in SAP Web Dispatcher

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-89126
EUVD
EUVD-2026-120674

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap web_dispatcher *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP Web Dispatcher has a flaw where it does not properly validate certain network input. This allows an unauthenticated attacker to send specially crafted network traffic that can trigger memory corruption in an internal component. If exploited successfully, this could let the attacker execute arbitrary code and fully take over the system.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual network traffic patterns or crashes in SAP Web Dispatcher. Check logs for memory corruption errors or unexpected terminations. Use network monitoring tools to inspect traffic directed at SAP Web Dispatcher ports. Ensure SAP Web Dispatcher is updated to the latest patch version to mitigate risks.

Impact Analysis

This vulnerability could allow an attacker to gain full control of the SAP Web Dispatcher system. This means they could access, modify, or delete sensitive data, disrupt services, or use the system as a foothold to attack other connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which would violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations using SAP Web Dispatcher may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Apply the latest security patches from SAP as referenced in SAP Note 3778556 to address the memory corruption vulnerability in SAP Web Dispatcher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...