Act nowDisclosed

Advisory · CVE-2026-89110

SAP NetWeaver Visual Composer flaw can compromise connected remote systems

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in portal functionality, letting a low-privileged attacker invoke internal operations on a preconfigured remote system, up to full compromise of that system. SAP rates it CVSS 3.1 9.9.

Advisory published October 13, 2026Independent summary
Vendor
SAP
Product
NetWeaver Visual Composer
Identifier / CWE
CVE-2026-89110
CWE-749
Action timing
Immediate
ELI5

Explain it like I’m five

Visual Composer forgets to check whether a low-privilege user may use its portal shortcuts, and those shortcuts reach into other connected systems.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Low-privilege sign-in

    An attacker with low privileges reaches the affected Visual Composer portal functionality.

  2. 02Internal operation invoked

    Without sufficient authorization checks, the attacker invokes internal operations on a preconfigured remote system.

  3. 03Remote compromise

    Depending on the remote connection configuration, the remote system can be fully compromised.

What happened

SAP disclosed CVE-2026-89110 for NetWeaver Visual Composer, affecting VC70RUNTIME 7.50. Certain portal functionality does not perform sufficient authorization checks (CWE-749), so a low-privileged attacker can invoke internal operations on a preconfigured remote system, which SAP says can lead to full compromise of that remote system. SAP scores it 9.9.

Apply SAP note 3797111 through the normal SAP patch process; this advisory does not name a fixed version beyond the note.

What to do

  1. Inventory every NetWeaver Visual Composer deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to NetWeaver Visual Composer while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for Visual Composer portal calls from low-privilege users and unexpected operations arriving at connected remote systems.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

The blast radius is the connected system, not just NetWeaver. Patch, and inventory which remote connections Visual Composer is configured to reach.