Key points
- CVE-2026-89110 affects SAP NetWeaver Visual Composer VC70RUNTIME 7.50.
- The flaw allows low-privilege attackers to invoke internal operations on remote systems.
- The NVD rates the vulnerability as critical with a CVSS score of 9.9.
The short version
- SAP NetWeaver Visual Composer contains a critical authorisation flaw.
- Low-privilege attackers can trigger operations on preconfigured remote systems.
- Successful exploitation may lead to full compromise of the remote system.
The details
SAP NetWeaver Visual Composer version 7.50 contains a severe security flaw that fails to perform sufficient authorisation checks in certain portal functionality. According to the National Vulnerability Database record for CVE-2026-89110, this weakness allows an attacker with low privileges to invoke internal operations on a preconfigured remote system. The flaw is classified under CWE-749. The primary impact stems from the lack of proper checks.
The National Vulnerability Database assigns a CVSS score of 9.9 to this issue, rating it as critical. This high score reflects the significant impact on confidentiality, integrity, and availability. An attacker does not need high-level credentials to exploit this vulnerability. Instead, they can leverage their low-privilege access to trigger actions that should be restricted, effectively bypassing the intended security boundaries of the application.
The risk extends beyond the local system where the flaw resides. Because the attacker can invoke operations on a preconfigured remote system, the impact depends heavily on how that remote connection is configured. If the remote system trusts the connection without additional verification, the attacker could achieve a full compromise of that remote environment. This means a breach in one part of the infrastructure could cascade into a total takeover of another.
The context
This vulnerability highlights the dangers of insufficient authorisation checks in enterprise software. SAP NetWeaver is a widely used platform for business applications, making such flaws particularly concerning for organisations that rely on it. The specific version affected is VC70RUNTIME 7.50. Organisations using this version must assess their exposure, especially if they have configured remote connections that could be targeted by low-privilege users.
The nature of the flaw suggests that internal operations are being triggered without verifying if the user has the right to do so. This is a common pattern in web application vulnerabilities where developers assume that access to a feature implies permission to use all its functions. In this case, the portal functionality allows the invocation of operations that should be protected, leading to the potential for remote system compromise.
Defender's checklist
Security teams should immediately inventory their SAP NetWeaver installations to identify any instances of Visual Composer VC70RUNTIME 7.50. They should review the configuration of remote connections associated with these systems. It is crucial to determine if low-privilege users have access to portal functionality that could trigger these internal operations. Isolating affected systems from critical remote resources may reduce the risk while a permanent solution is sought.
What to do and how to stay safe: SAP
- Audit user permissions to ensure low-privilege accounts cannot access sensitive portal functions.
- Review remote connection configurations to limit the actions that can be triggered from the vulnerable system.
- Monitor logs for unusual internal operations invoked by low-privilege users.
- Contact your vendor to inquire about patches or temporary mitigations for CVE-2026-89110.
Step-by-step guide: Unpatched Software: Why Missing Updates Create Hidden Entry Points
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-89110?
It is a critical vulnerability in SAP NetWeaver Visual Composer that allows low-privilege attackers to invoke internal operations on remote systems.
Which version of SAP NetWeaver is affected?
The vulnerability affects SAP NetWeaver Visual Composer VC70RUNTIME 7.50.
How severe is this vulnerability?
The National Vulnerability Database rates it as critical with a CVSS score of 9.9.
