CVE-2026-89110
CriticalCVSS 9.9Summary
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could lead to full compromise of the remote system.
Risk Assessment
An attacker with low privileges could gain full control over the remote system, leading to high impact on confidentiality, integrity, and availability of data. This could result in takeover of critical systems and organizational data.
Recommendation
Upgrade SAP NetWeaver Visual Composer to a patched version. Additionally, review remote connection configurations and restrict access to portal functionality.
Other vulnerabilities in SAP NetWeaver Visual Composer
See all- CVE-2025-42999CriticalActively exploited
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable to insecure deserialization when a privileged user uploads untrusted or malicious content. This could lead to compromise of confidentiality, integrity, and availability of the host system.
- CVE-2025-31324CriticalActively exploited
SAP NetWeaver Visual Composer Metadata Uploader is not protected with proper authorization, allowing unauthenticated agents to upload potentially malicious executable binaries that could severely harm the host system. This affects confidentiality, integrity, and availability.
Original NVD description (English source)
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS