SAP NetWeaver Visual Composer Flaw Allows Low-Privilege Attackers to Compromise Remote Systems
A critical authorization bypass in SAP NetWeaver Visual Composer 7.50 lets attackers invoke internal operations on remote systems, risking full compromise.
Key points
- CVE-2026-89110 is rated critical with a CVSS score of 9.9 due to insufficient authorization checks.
- Attackers with low privileges can invoke internal operations on preconfigured remote systems.
- The flaw affects SAP NetWeaver Visual Composer VC70RUNTIME version 7.50 and impacts confidentiality, integrity, and availability.
A critical security vulnerability in SAP NetWeaver Visual Composer allows attackers with minimal privileges to execute internal operations on connected remote systems. The flaw, identified as CVE-2026-89110, stems from insufficient authorization checks within specific portal functionality, creating a significant risk for organizations using this software.
At a glance
- CVE
- CVE-2026-89110
- Product
- SAP_SE SAP NetWeaver Visual Composer
- CVSS
- 9.9 Critical
- Weakness
- CWE-749
- Exploited
- No known exploitation
The National Vulnerability Database records the issue with a CVSS score of 9.9, classifying it as critical. This high severity rating reflects the potential for a full compromise of the remote system, depending on how the remote connections are configured. The weakness is categorized under CWE-749, which relates to improper verification of intent or authority.
Context and Background
The vulnerability exists because SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. According to the NVD record, an attacker with low privileges can exploit this gap to invoke internal operations on a preconfigured remote system. This bypass allows unauthorized access to system functions that should be restricted.
The impact of this flaw extends beyond the immediate application. Depending on the remote connection configuration, the exploitation could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity, and availability, as stated in the vulnerability description.
Who Is Affected
The vulnerability specifically affects SAP NetWeaver Visual Composer VC70RUNTIME version 7.50. Organizations running this specific version of the software are exposed to the risk of unauthorized remote system access. The flaw is inherent in the software's handling of portal functionality and authorization checks.
No other versions or products are explicitly listed in the available records. Users of SAP NetWeaver Visual Composer should verify their current version to determine if they are impacted by this specific release. The scope is limited to the VC70RUNTIME 7.50 release.
What should you do?
No fix or patch has been confirmed yet for this vulnerability. Organizations should monitor official channels from SAP for updates regarding CVE-2026-89110. In the meantime, limiting network access to affected systems may reduce the risk of exploitation.
What to do and how to stay safe: SAP
- Verify if your environment runs SAP NetWeaver Visual Composer VC70RUNTIME version 7.50 to determine exposure.
- Restrict network access to systems running the affected software to limit potential attack surfaces.
- Monitor official vendor communications for the release of a security update or patch.
- Review logs for any unauthorized internal operations or unusual activity on remote systems.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-89110?
The CVSS score for CVE-2026-89110 is 9.9, which is classified as critical.
Which version of SAP NetWeaver Visual Composer is affected?
The vulnerability affects SAP NetWeaver Visual Composer VC70RUNTIME version 7.50.
Can an attacker with low privileges exploit this flaw?
Yes, an attacker with low privileges can invoke internal operations on a preconfigured remote system.
