CVE-2026-89120
Received Received - Intake

Authorization Bypass in SAP ABAP Platform via Session Manager

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89120
EUVD
EUVD-2026-98199

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SAP_SE SAP ABAP Platform KERNEL 7.93
SAP_SE SAP ABAP Platform 9.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a regression in SAP ABAP Platform caused by an API change. It reintroduces a previously fixed authorization weakness where the session manager can be opened in single transaction mode, including from the SAP Fiori Launchpad (FLP). A low-privileged attacker could exploit this to bypass restrictions by sending specially crafted requests.

Impact Analysis

A low-privileged attacker could bypass authorization restrictions, potentially gaining unauthorized access to sensitive functions or data. This could lead to unauthorized modifications (high impact on integrity) but does not affect confidentiality or availability.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, which may violate integrity requirements in GDPR and HIPAA. Compliance could be impacted if unauthorized changes occur to personal or health data, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Apply the official SAP security note 3626303 to address the regression in the session manager API. Monitor SAP ABAP Platform updates and restrict low-privileged user access to transaction modes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart