CVE-2026-89110: SAP NetWeaver Visual Composer Auth Bypass

CVE-2026-89110 Overview

CVE-2026-89110 is a critical authorization flaw in SAP NetWeaver Visual Composer. The vulnerability allows a low-privileged attacker to invoke internal operations on preconfigured remote systems through portal functionality that fails to enforce sufficient authorization checks. Depending on how the remote connection is configured, successful exploitation can lead to a full compromise of the connected remote system, impacting confidentiality, integrity, and availability. The weakness is classified as [CWE-749] (Exposed Dangerous Method or Function). SAP addressed the issue through SAP Security Patch Day guidance and SAP Note #3797111.

Critical Impact
An authenticated attacker with low privileges can invoke internal operations against remote systems, potentially achieving full compromise of connected backends.

Affected Products

SAP NetWeaver Visual Composer (portal functionality component)
SAP NetWeaver installations exposing Visual Composer portal services
Downstream remote systems connected through preconfigured Visual Composer destinations

Discovery Timeline

2026-10-13 - CVE-2026-89110 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-89110

Vulnerability Analysis

The vulnerability resides in SAP NetWeaver Visual Composer portal functionality. The portal exposes internal operations without validating whether the invoking user holds the required authorization. An authenticated attacker with low privileges can call these operations and route them to any remote system that administrators have preconfigured as a destination.

Because the request executes under the trust context of the configured remote connection, the attacker inherits the privileges associated with that destination. When the destination is bound to a privileged technical account, the attacker gains the ability to execute sensitive functions on the backend system. The attack scope changes beyond the vulnerable component, which is why the impact can cascade across connected SAP systems.

Root Cause

The root cause is missing authorization enforcement on exposed portal methods, consistent with [CWE-749]. Visual Composer presents functions intended for internal or administrative use without gating them behind an authorization check appropriate to the sensitivity of the operation. The portal relies on authentication alone and does not verify whether the caller has permission to trigger the downstream operation.

Attack Vector

The attack is network-based and requires low-privileged authenticated access to the SAP NetWeaver portal. An attacker sends crafted requests to the Visual Composer portal endpoints that expose the internal operations. The portal forwards these operations to a preconfigured remote system using its configured credentials, bypassing authorization checks that would normally restrict the caller. No user interaction is required, and the impact extends to systems reachable through configured remote destinations.

No verified public proof-of-concept code is available at the time of publication. Refer to SAP Note #3797111 for technical details available to licensed customers.

Detection Methods for CVE-2026-89110

Indicators of Compromise

Unexpected invocations of Visual Composer internal operations by non-administrative users in portal access logs
Outbound RFC or HTTP destination calls originating from Visual Composer at times inconsistent with normal business activity
New or modified objects on remote systems that correlate with Visual Composer-initiated sessions
Authentication events on backend systems using the technical account bound to a Visual Composer destination without a matching administrator workflow

Detection Strategies

Review SAP Security Audit Log (SM20) entries for Visual Composer services and flag calls to internal operation handlers from low-privileged users
Correlate portal HTTP access logs with RFC gateway logs (SMGW) to identify requests that chain through preconfigured destinations
Baseline normal Visual Composer traffic volume and alert on deviations in operation types or destination usage

Monitoring Recommendations

Enable detailed logging on Visual Composer portal services and forward logs to a centralized SIEM for retention and correlation
Monitor privileged technical accounts tied to RFC destinations for authentication events sourced from NetWeaver AS Java
Track changes to Visual Composer models, destinations, and portal roles through SAP change documents

How to Mitigate CVE-2026-89110

Immediate Actions Required

Apply the SAP security patch referenced in SAP Note #3797111 as soon as change management permits
Audit all preconfigured Visual Composer remote destinations and remove or restrict any that connect using highly privileged accounts
Review portal role assignments and revoke Visual Composer access from users who do not require it
Rotate credentials for technical accounts used by Visual Composer destinations after patching

Patch Information

SAP released a fix as part of SAP Security Patch Day. Customers must obtain and apply the correction through SAP Note #3797111. Additional context on the release cycle is available through the SAP Security Patch Day Announcement. Verify that the patch is applied on all NetWeaver AS Java systems running Visual Composer.

Workarounds

Disable Visual Composer runtime components on systems where the functionality is not required for business operations
Restrict network access to the NetWeaver portal to trusted internal networks and VPN users until the patch is deployed
Reconfigure RFC destinations used by Visual Composer to use least-privilege service accounts rather than administrative credentials
Apply SAP Unified Connectivity (UCON) controls to limit which RFC function modules are callable from external contexts

bash

# Example: review Visual Composer destinations and audit configuration
# Transaction SM59 - inspect RFC destinations referenced by Visual Composer
# Transaction UCONCOCKPIT - enable Unified Connectivity to restrict callable RFMs
# Transaction SM20 - review Security Audit Log for Visual Composer activity
# After patching per SAP Note #3797111, validate kernel and component versions:
#   System > Status > Component Information