CVE-2026-89120: SAP ABAP Platform Auth Bypass Vulnerability

CVE-2026-89120 Overview

CVE-2026-89120 is an authorization bypass vulnerability in the SAP ABAP Platform. A regression introduced by an API change reintroduced a previously fixed authorization weakness in the session manager. The session manager can be opened in single transaction mode, including from the SAP Fiori Launchpad (FLP). A low-privileged attacker can send specially crafted requests over the network to bypass intended transaction restrictions. Successful exploitation produces high impact on integrity and low impact on confidentiality, with no availability impact. The weakness is classified under CWE-1188: Initialization of a Resource with an Insecure Default.

Critical Impact
An authenticated low-privileged user can bypass transaction-level authorization controls and tamper with business data through the SAP ABAP Platform session manager.

Affected Products

SAP ABAP Platform (session manager component)
SAP Fiori Launchpad (FLP) integration path
SAP installations exposing single transaction mode via session manager

Discovery Timeline

2026-10-13 - CVE-2026-89120 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-89120

Vulnerability Analysis

The vulnerability resides in the SAP ABAP Platform session manager. An API change regressed a prior authorization fix, allowing the session manager to be invoked in single transaction mode. This mode can be reached directly or through the Fiori Launchpad entry path. An authenticated attacker holding only basic application privileges can issue crafted requests to open restricted transactions. The attack targets integrity: an adversary can execute transactions that modify business data outside their intended authorization scope. Confidentiality impact is limited, and the service remains available during exploitation. Because the attack vector is network-based and complexity is low, exploitation does not require social engineering or local access.

Root Cause

The root cause is a regression tied to an API change inside the session manager code path. A previously enforced authorization check was effectively removed when the session manager started accepting single transaction mode invocations from the Fiori Launchpad. This matches [CWE-1188], where a resource (the session) is initialized with insecure defaults that no longer enforce the authorization constraints originally present.

Attack Vector

Exploitation requires valid but low-privileged credentials to the SAP ABAP Platform. The attacker sends a crafted HTTP request to the session manager endpoint, specifying single transaction mode and the target transaction code. Because the regression bypasses the transaction authorization check, the platform launches the requested transaction regardless of the caller's role assignments. The attacker can then alter configuration or business records accessible through that transaction.

No verified public exploit code is available. Refer to SAP Security Note #3626303 for vendor technical details.

Detection Methods for CVE-2026-89120

Indicators of Compromise

Session manager requests invoking single transaction mode from accounts without the corresponding transaction authorizations
Fiori Launchpad navigation events that bridge directly into backend transactions normally gated by role checks
Audit log entries showing successful transaction starts for users who lack the matching S_TCODE authorization

Detection Strategies

Enable and review the SAP Security Audit Log (SM19/RSAU_CONFIG) for anomalous AU3 and AU5 events tied to session manager launches
Correlate FLP access logs with ABAP backend transaction starts to flag mismatches between user role scope and executed transaction codes
Baseline normal transaction usage per role and alert on first-seen transactions executed by low-privileged users

Monitoring Recommendations

Forward SAP audit, HTTP, and change document logs to a centralized SIEM for cross-source correlation
Monitor administrative and finance transaction codes (for example SU01, SE16, SM59, FB01) for execution by non-privileged principals
Track changes to critical tables and configuration objects immediately after session manager activity

How to Mitigate CVE-2026-89120

Immediate Actions Required

Apply the fix referenced in SAP Security Note #3626303 during the next maintenance window
Inventory ABAP Platform systems and Fiori Launchpad deployments to identify exposed instances
Review authorization assignments for low-privileged users and remove unnecessary access to sensitive transactions

Patch Information

SAP addressed the regression in the October 2026 Security Patch Day release. Customers should download and apply the correction notes referenced in SAP Security Note #3626303 and consult the SAP Security Patch Day Announcement for the full patch bundle and prerequisite notes.

Workarounds

Restrict network access to the SAP ABAP Platform and Fiori Launchpad endpoints to trusted segments where feasible
Tighten S_TCODE and application role authorizations so that low-privileged users cannot reach sensitive transactions even if the session manager check fails
Increase SAP Security Audit Log verbosity for session manager and transaction start events until the patch is deployed

bash

# Enable SAP Security Audit Log for session and transaction events
# Reference: configure via transaction RSAU_CONFIG or SM19
# Example filter: capture successful and failed transaction starts for all users
# Classes to enable: Logon, Transaction start, RFC call, User master changes
# After patch deployment, review the log via transaction RSAU_READ_LOG