CVE-2026-89126 Memory Corruption vulnerability in SAP Web Dispatcher
CriticalCVSS 10.0
- Published
- Updated
- Exploit status
- No public exploit known
Description
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAP Web Dispatcher | = HDB 2.00 | No fix listed |
| SAP_SE SAP Web Dispatcher | = KRNL64UC 7.53 | No fix listed |
| SAP_SE SAP Web Dispatcher | = WEBDISP 7.53 | No fix listed |
| SAP_SE SAP Web Dispatcher | = 7.54 | No fix listed |
| SAP_SE SAP Web Dispatcher | = 7.77 | No fix listed |
| SAP_SE SAP Web Dispatcher | = 7.93 | No fix listed |
| SAP_SE SAP Web Dispatcher | = 9.16 | No fix listed |
| SAP_SE SAP Web Dispatcher | = XS_ADVANCED_RUNTIME 1.00 | No fix listed |
| SAP_SE SAP Web Dispatcher | = SAP_EXTENDED_APP_SERVICES 1 | No fix listed |
| SAP_SE SAP Web Dispatcher | = KERNEL 7.53 | No fix listed |
| SAP_SE SAP Web Dispatcher | = 9.18 | No fix listed |
| SAP_SE SAP Web Dispatcher | = 9.20 | No fix listed |