Key points
- CVE-2026-89110 affects SAP NetWeaver Visual Composer version 7.50 runtime.
- The flaw carries a CVSS score of 9.9, rated as critical severity.
- Attackers with low privileges can invoke internal operations on preconfigured remote systems.
A new vulnerability in SAP NetWeaver Visual Composer allows attackers with minimal permissions to compromise remote systems. The issue stems from insufficient authorisation checks within the portal’s functionality, leading to a critical severity rating from security analysts.
What happened
The National Vulnerability Database records CVE-2026-89110 as affecting SAP NetWeaver Visual Composer version 7.50 runtime. The flaw involves a failure to perform sufficient authorisation checks in certain portal functions. According to the NVD record, this weakness is categorised under CWE-749. An attacker with low privileges can exploit this gap to invoke internal operations on a preconfigured remote system.
The vulnerability does not require high-level administrative access to trigger. Instead, it leverages existing connections between the visual composer and other systems. The NVD description states that the impact depends on the specific configuration of the remote connection. This lack of proper verification allows the attacker to execute actions that should be restricted.
Why it matters
The vulnerability carries a CVSS score of 9.9, which is rated as critical. This score reflects a high impact on confidentiality, integrity and availability. According to the NVD, the flaw can lead to a full compromise of the remote system. This means that an attacker does not necessarily need to breach the main SAP server directly.
By targeting the visual composer, they can pivot to other connected infrastructure. The low privilege requirement makes this threat accessible to a wider range of attackers. Even users with limited access within the organisation could potentially exploit the flaw. The critical rating indicates that the risk is severe and requires immediate attention from security teams.
What happens next
Security operations teams should verify if they are running the affected version. Organisations must check their remote connection configurations for exposed systems. Monitoring for unusual internal operations invoked by low-privilege accounts is essential. Teams should review access logs for any signs of unauthorised portal functionality usage. Isolation of affected systems may be necessary until a mitigation strategy is confirmed. Regular audits of authorisation checks in portal functions are recommended.
What to do and how to stay safe: SAP
- Audit all SAP NetWeaver Visual Composer installations for version 7.50 runtime.
- Review remote connection configurations to limit potential exposure from internal operations.
- Monitor logs for unauthorised invocations of portal functionality by low-privilege users.
- Restrict access to portal functions until further guidance is provided by the vendor.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What version of SAP NetWeaver is affected by CVE-2026-89110?
The vulnerability affects SAP NetWeaver Visual Composer VC70RUNTIME version 7.50.
What is the severity rating of this vulnerability?
The CVSS score is 9.9, which is rated as critical severity.
How can an attacker exploit this flaw?
An attacker with low privileges can invoke internal operations on a preconfigured remote system.
