# CVE-2026-89125: SAP Web Dispatcher and Internet Communication Manager insecure sensitive information storage

Source: https://junglewise.ai/threats/cve-2026-89125-due-to-insecure-storage-of-sensitive-information-in-sap-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-89125 · Severity: medium · CVSS 6 · Published 2026-11-10

SAP Web Dispatcher and Internet Communication Manager store sensitive authentication credentials insecurely, allowing an attacker with administrative access to extract and correlate credentials across systems. This could enable unauthorized access to multiple SAP deployments by reusing exposed credentials, compromising the confidentiality of user accounts and system data.

Technologies: [SAP Web Dispatcher](https://junglewise.ai/threats/technologies/web-dispatcher). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-89125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89125 being exploited in the wild.

**How severe is CVE-2026-89125?** Medium severity, with a CVSS score of 6, published 10 November 2026.

**Which products and versions are affected?** SAP Web Dispatcher; SAP Internet Communication Manager.

**Is there a fix for CVE-2026-89125?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89125 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-89125?** Check whether you run SAP Internet Communication Manager or SAP Web Dispatcher. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability involves insecure storage of sensitive information in SAP Web Dispatcher and Internet Communication Manager, allowing administrators to extract stored credentials. The attack requires administrative privileges and results in credential exposure that may be correlated across multiple users and deployments. The issue affects confidentiality primarily, with limited impact on integrity and availability.

## Affected products

- SAP Web Dispatcher
- SAP Internet Communication Manager

## Timeline

- 2026-11-10: disclosed

## References

- [https://me.sap.com/notes/3782056](https://me.sap.com/notes/3782056)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP Web Dispatcher input validation memory corruption](https://junglewise.ai/threats/cve-2026-89126-sap-web-dispatcher-does-not-sufficiently-validate-certain-network)
- [SAP Web Dispatcher and NetWeaver Application Server ABAP CSRF in administrative functionality](https://junglewise.ai/threats/cve-2026-89119-sap-web-dispatcher-and-sap-netweaver-application-server-abap)
- [SAP Web Dispatcher input validation memory corruption](https://junglewise.ai/threats/cve-2026-109800-sap-web-dispatcher-does-not-sufficiently-validate-certain-inputs)
- [SAP NetWeaver Application Server ABAP denial of service](https://junglewise.ai/threats/cve-2026-109794-sap-netweaver-application-server-abap-abap-platform-and-sap-web)
- [SAP NetWeaver Application Server ABAP and Web Dispatcher header validation DoS](https://junglewise.ai/threats/cve-2026-109793-sap-netweaver-application-server-abap-and-sap-web-dispatcher-do)