{"id":"EUVD-2026-120662","enisaUuid":"34d2e3b6-6e3b-33a5-b139-2568060dfae1","description":"SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.","datePublished":"Nov 10, 2026, 12:18:43 AM","dateUpdated":"Nov 10, 2026, 12:18:43 AM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://me.sap.com/notes/3798345\nhttps://url.sap/sapsecuritypatchday\n","aliases":"CVE-2026-89103\nGHSA-p6vw-54fj-mjm4\n","assigner":"sap","epss":0.0,"enisaIdProduct":[{"id":"043193fd-04a5-380a-87a2-7fe417cba8ad","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.53"},{"id":"05597f50-8a50-3e20-bb47-b8e5cfbc91a4","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"9.21"},{"id":"0dd3f3dd-9378-37af-88bb-e946f28205d9","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"8.04"},{"id":"27ee0000-8983-393d-b7f3-3258d1ceb55d","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.54"},{"id":"378fa05d-3e36-38ad-93d0-a5795cdcdb11","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"KERNEL 7.22"},{"id":"3b2efb37-97df-38b6-bc47-fb70f11d79ce","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.22EXT"},{"id":"511d71f4-6bef-351e-8e67-172a187e1770","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"9.16"},{"id":"813d85af-b081-3ed4-94df-a2f6c809359a","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"9.20"},{"id":"872da9e8-2ec7-37d0-8bbb-41e82904f76f","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"KRNL64NUC 7.22"},{"id":"8fdfece3-a5d5-3dfa-920d-9849df7a9e11","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.93"},{"id":"a4fbc149-1b66-3377-a118-f967b355d880","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"KRNL64UC 7.22"},{"id":"ea69a001-8cc5-3e65-b91f-f5fd4fc3bc8f","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.77"}],"enisaIdVendor":[{"id":"3a1c7151-fc5a-3990-9cf8-b6cfdda011bc","vendor":{"name":"SAP_SE"}}],"enisaIdVulnerability":[{"id":"51f56e7e-c5b8-3832-97c1-4e72d8322e13","vulnerability":{"id":"GHSA-p6vw-54fj-mjm4","description":"SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.","datePublished":"Nov 10, 2026, 3:30:34 AM","dateUpdated":"Nov 10, 2026, 3:30:34 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-89103\nhttps://me.sap.com/notes/3798345\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-120662\n","aliases":"CVE-2026-89103\nGHSA-p6vw-54fj-mjm4\n","epss":0.0,"dataProcessed":"Nov 10, 2026, 8:01:41 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c9342473-13e4-3ac2-b971-36f397e680a0","vulnerability":{"id":"CVE-2026-89103","description":"SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.","datePublished":"Nov 10, 2026, 12:18:43 AM","dateUpdated":"Nov 10, 2026, 12:18:43 AM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://me.sap.com/notes/3798345\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-120662\n","assigner":"sap","epss":0.0,"dataProcessed":"Nov 10, 2026, 8:00:17 AM","vulnerabilityProduct":[{"id":"00056caf-14a3-34a6-b341-300d24645f32","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.54"},{"id":"15399a9d-6a77-3d70-b237-288651ebab44","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"9.16"},{"id":"1bcd22d2-7f77-353a-9724-4bda49a101f4","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"KRNL64UC 7.22"},{"id":"1cb3f7b8-701d-3b52-9dcc-37515ff7cc8b","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.22EXT"},{"id":"1f62de1f-ab1b-311a-8631-42976faa515a","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"9.21"},{"id":"34d98f2d-b9c8-3aec-94cd-559c68dbb1bd","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.93"},{"id":"37c420bd-7ad6-368a-b082-098f38eca86a","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.53"},{"id":"63b26ac3-34f2-3c90-8d50-00b3a974f2f6","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"7.77"},{"id":"6a821808-09cf-35a7-b76b-86b5292f3ad9","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"9.20"},{"id":"888bfc17-2c86-37cc-bb8a-7364462decab","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"KERNEL 7.22"},{"id":"d03c1a60-5e28-31cd-8d1c-dd3d4eadf1a9","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"8.04"},{"id":"df8c3f45-1ee4-3d74-977e-1a84261246f7","product":{"name":"SAP Gateway","vendor":{"name":"SAP SE"}},"product_version":"KRNL64NUC 7.22"}],"vulnerabilityVendor":[{"id":"b682d0f6-14ba-38d5-ad0f-c7e29ca74b75","vendor":{"name":"SAP_SE"}}]}}],"enisaIdAdvisory":[]}