Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager
CVE-2026-89125

6MEDIUM

Key Information:

Vendor

SAP
Status
SAP Web Dispatcher And Internet Communication Manager
Vendor
CVE Published:
10 November 2026

What is CVE-2026-89125?

The SAP Web Dispatcher and Internet Communication Manager contain a vulnerability due to insecure storage of sensitive information. This flaw could allow an attacker with administrative privileges to retrieve confidential data from storage. As a result, credentials may become correlated across different users and deployments, leading to potential unauthorized access. Organizations using the affected products should be aware of the risks associated with credential exposure and take immediate measures to secure their environments.

Affected Version(s)

SAP Web Dispatcher and Internet Communication Manager KRNL64NUC 7.22

SAP Web Dispatcher and Internet Communication Manager KRNL64NUC 7.22EXT

SAP Web Dispatcher and Internet Communication Manager KRNL64UC 7.22

References

https://me.sap.com/notes/3782056
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.