SAP NetWeaver Visual Composer: Broken access control in portal functionality
Summary
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with a low-privileged account on the portal could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of that remote system.
Affected
- SAP NetWeaver Visual Composer, VC70RUNTIME 7.50 (according to the CVE record; the default configuration is unaffected)
- Only NetWeaver Java systems with Visual Composer deployed are relevant
Fixed in
- Fix available: SAP Security Note 3797111 (released 13 October 2026)
- Exact patch level or support package: Unknown. See the support package and patch section of the note.
Workaround
- Unknown exact measure. SAP Note 3797111 describes temporary measures; reported options include a restart of the Visual Composer component and a security setting ("Secure Mode"). Verify in the note before use.
- Review which remote destinations Visual Composer can reach and which permissions they hold.
Exploitation
- No public proof of concept or exploit code known.
- Not listed in the CISA KEV catalog as of the sources reviewed.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory NetWeaver systems and identify Java-stack systems with Visual Composer deployed.
- Apply SAP Security Note 3797111 with priority. If delayed, apply the workaround from the note.
- Check whether the NetWeaver portal is reachable from the internet and restrict access.
- Review Visual Composer remote destinations and their permissions, and limit portal accounts to what is needed.
- Monitor for public exploit code and CISA KEV changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SAP Security Note 3797111 me.sap.com
- SAP Security Patch Day url.sap
- OpenCVE CVE-2026-89110 app.opencve.io
- SecurityBridge: SAP Security Patch Day October 2026 securitybridge.com
- Onapsis: SAP Security Patch Day October 2026 onapsis.com
- Pathlock: SAP Patch Day October 2026 pathlock.com
- CyCognito: CVE-2026-89110 analysis www.cycognito.com
- VulDB CVE-2026-89110 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:27.
Original description (NVD)
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.