Skip to content
OpenAdvisories
Critical · 10.0 CVE-2026-89126 EUVD-2026-120674GHSA-cc52-vh2m-f9wq

Memory Corruption vulnerability in SAP Web Dispatcher

Published Nov 10, 2026 · Updated Nov 11, 2026 · Assigned by sap

Description

SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Affected products

VendorProductAffectedFixed
SAP_SE SAP Web Dispatcher HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 9.18, 9.20 —

Advisories 2

References