Input Validation Flaw in SAP NetWeaver Enterprise Portal
CVE-2026-89122

6.1MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Enterprise Portal
Vendor
CVE Published:
13 October 2026

What is CVE-2026-89122?

The SAP NetWeaver Enterprise Portal contains an input validation flaw within a specific portal component. This vulnerability can be exploited by an unauthenticated attacker who crafts a malicious link. When a user clicks the link, it can lead to the loading of unauthorized content within the secure context of the trusted application. Successful exploitation may enable the attacker to track sensitive user information and alter the webpage's appearance, posing risks to user confidentiality and the integrity of the content presented.

Affected Version(s)

SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50

References

https://me.sap.com/notes/3790401
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.