{"id":"EUVD-2026-120674","enisaUuid":"461d7521-0ced-3fba-84f6-8e2b5b2fd81d","description":"SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","datePublished":"Nov 10, 2026, 12:34:43 AM","dateUpdated":"Nov 10, 2026, 12:34:43 AM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://me.sap.com/notes/3778556\nhttps://url.sap/sapsecuritypatchday\n","aliases":"CVE-2026-89126\nGHSA-cc52-vh2m-f9wq\n","assigner":"sap","epss":0.0,"enisaIdProduct":[{"id":"004cba9e-1e1a-342d-a117-b0fe3a5a9521","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"9.20"},{"id":"0105d9c2-51a2-3054-b058-91adaee5bf41","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"HDB 2.00"},{"id":"1091fede-fa3c-3850-bb28-3572adc6a87e","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"7.77"},{"id":"66024706-a36d-3f45-a4bf-0734c584b56a","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"XS_ADVANCED_RUNTIME 1.00"},{"id":"7935008f-5e3d-3b69-aa45-3fbf743cddda","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"SAP_EXTENDED_APP_SERVICES 1"},{"id":"a4da7105-9463-3ee6-9a7b-dfe8157378aa","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"WEBDISP 7.53"},{"id":"aed1074d-f88b-3a63-a0ff-ea65d8ea899a","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"9.16"},{"id":"b3837be1-c81a-3305-8da1-15658f671942","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"7.93"},{"id":"b46e1d4d-e1ed-350c-9827-6a13b6e2c2de","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"9.18"},{"id":"bf5e21e9-7c8b-3e31-a109-d96ee96c90a7","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"KRNL64UC 7.53"},{"id":"c31aa99e-7b37-38fb-abcc-84bc5a0137ad","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"KERNEL 7.53"},{"id":"e384a942-20f0-31f4-865e-19030222152e","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"7.54"}],"enisaIdVendor":[{"id":"7b27a936-b264-359d-baac-62340fae6f55","vendor":{"name":"SAP_SE"}}],"enisaIdVulnerability":[{"id":"249c5897-58e1-3fde-8e1b-8a0c792649dd","vulnerability":{"id":"CVE-2026-89126","description":"SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","datePublished":"Nov 10, 2026, 12:34:43 AM","dateUpdated":"Nov 10, 2026, 12:34:43 AM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://me.sap.com/notes/3778556\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-120674\n","assigner":"sap","epss":0.0,"dataProcessed":"Nov 10, 2026, 8:00:17 AM","vulnerabilityProduct":[{"id":"14112312-74c3-37e3-b077-6eeb7fa2c85d","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"KRNL64UC 7.53"},{"id":"1fb2ecb5-0c50-3ca4-94bd-1f60a6b533b8","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"9.20"},{"id":"387d74bc-e521-3087-bb36-050bacf6ed2c","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"WEBDISP 7.53"},{"id":"82fa4458-be0f-3ccb-93d7-39d7698f6b93","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"7.93"},{"id":"83c52d59-995a-3e75-9bda-6ac6ebe5722d","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"HDB 2.00"},{"id":"c2b0afb5-5c22-350a-a197-e422bdecd4fd","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"9.16"},{"id":"cae01eae-e632-3bf7-b44d-c28dcfaa144b","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"KERNEL 7.53"},{"id":"cdaa17a7-1233-3e82-958f-d35401b83ca0","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"9.18"},{"id":"e123a5ba-ee1f-39a0-93f5-263f3d0d46e5","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"7.77"},{"id":"e855ade1-4ee9-3683-9a19-c53290048a86","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"SAP_EXTENDED_APP_SERVICES 1"},{"id":"e86ab32d-670e-392a-ac41-ac04343f2d66","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"7.54"},{"id":"fd8a8c1a-2f76-35e4-b445-16a82008d212","product":{"name":"SAP Web Dispatcher","vendor":{"name":"SAP SE"}},"product_version":"XS_ADVANCED_RUNTIME 1.00"}],"vulnerabilityVendor":[{"id":"ef203a74-e71b-3a3d-8c54-3b3f61005d5d","vendor":{"name":"SAP_SE"}}]}},{"id":"c15b4ffd-209e-3651-ace4-493355565e42","vulnerability":{"id":"GHSA-cc52-vh2m-f9wq","description":"SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","datePublished":"Nov 10, 2026, 3:30:34 AM","dateUpdated":"Nov 10, 2026, 3:30:34 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-89126\nhttps://me.sap.com/notes/3778556\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-120674\n","aliases":"CVE-2026-89126\nGHSA-cc52-vh2m-f9wq\n","epss":0.0,"dataProcessed":"Nov 10, 2026, 8:01:41 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}