CVE-2026-89103 Broken Access Control in SAP Gateway
CriticalCVSS 10.0
- Published
- Updated
- Exploit status
- No public exploit known
Description
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAP Gateway | = KRNL64NUC 7.22 | No fix listed |
| SAP_SE SAP Gateway | = 7.22EXT | No fix listed |
| SAP_SE SAP Gateway | = KRNL64UC 7.22 | No fix listed |
| SAP_SE SAP Gateway | = 7.53 | No fix listed |
| SAP_SE SAP Gateway | = 8.04 | No fix listed |
| SAP_SE SAP Gateway | = KERNEL 7.22 | No fix listed |
| SAP_SE SAP Gateway | = 7.54 | No fix listed |
| SAP_SE SAP Gateway | = 7.77 | No fix listed |
| SAP_SE SAP Gateway | = 7.93 | No fix listed |
| SAP_SE SAP Gateway | = 9.16 | No fix listed |
| SAP_SE SAP Gateway | = 9.20 | No fix listed |
| SAP_SE SAP Gateway | = 9.21 | No fix listed |