# CVE-2026-89110: SAP NetWeaver Visual Composer authorization bypass in portal functionality

Source: https://junglewise.ai/threats/cve-2026-89110-sap-netweaver-visual-composer-does-not-perform-sufficient  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-89110 · Severity: critical · CVSS 9.9 · Published 2026-10-13

SAP NetWeaver Visual Composer, a portal development component, fails to properly check user permissions for certain operations. An attacker with a low-privilege account can invoke internal operations on preconfigured remote systems, potentially compromising the confidentiality, integrity, and availability of those systems. Depending on the remote system's configuration and data, this could lead to complete system compromise.

Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-89110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89110 being exploited in the wild.

**How severe is CVE-2026-89110?** Critical severity, with a CVSS score of 9.9, published 13 October 2026.

**Which products and versions are affected?** SAP NetWeaver Visual Composer.

**Is there a fix for CVE-2026-89110?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89110 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89110?** Check whether you run SAP NetWeaver Visual Composer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in SAP NetWeaver Visual Composer's portal functionality that fails to perform sufficient access control checks before allowing invocation of internal operations on remote systems. An attacker with low privileges can exploit this to execute operations they should not have permission to perform. The impact depends on the configuration of the remote system connection and what data or systems it provides access to.

## Affected products

- SAP NetWeaver Visual Composer

## Timeline

- 2026-10-13: disclosed

## References

- [https://me.sap.com/notes/3797111](https://me.sap.com/notes/3797111)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP NetWeaver Visual Composer cross-site scripting](https://junglewise.ai/threats/cve-2026-120016-sap-netweaver-visual-composer-does-not-perform-sufficient-input)