Request Validation Vulnerability in SAP HANA XSA Web Dispatcher
CVE-2026-120014

7.6HIGH

Key Information:

Vendor

SAP
Status
SAP Web Dispatcher And Internet Communication Manager
Vendor
CVE Published:
10 November 2026

What is CVE-2026-120014?

The SAP HANA XSA Web Dispatcher exhibits a vulnerability due to inadequate request validation within certain administrative functionalities. This flaw enables an unauthenticated attacker to deceive a logged-in administrator into clicking on a malicious link, thereby executing unintended actions during the administrator's session. Exploitation of this vulnerability can lead to temporary compromises of the SAP HANA XSA Web Dispatcher, posing risks to confidentiality as well as partial threats to integrity and availability.

Affected Version(s)

SAP Web Dispatcher and Internet Communication Manager WEBDISP 7.93

SAP Web Dispatcher and Internet Communication Manager 9.16

SAP Web Dispatcher and Internet Communication Manager XS_ADVANCED_RUNTIME 1.00

References

https://me.sap.com/notes/3804858
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.