CVE-2026-89110

Executive Summary

CVE-2026-89110 is a missing/insufficient authorization vulnerability (CWE-749) in SAP NetWeaver Visual Composer portal functionality, scoring 9.9 (Critical) on CVSS v3.1. An attacker holding only low-privileged credentials can invoke internal operations on a preconfigured remote system via the portal, and depending on how that remote connection is configured, this can escalate to full compromise of the remote system. Because exploitation requires only authenticated low-privilege access over the network with no user interaction, any organization exposing a SAP NetWeaver Visual Composer portal with backend remote-connection configurations is at high risk; confidentiality, integrity, and availability impacts are all rated High with a Changed scope.

Technical Analysis

The vulnerability class is CWE-749 ("Exposed Dangerous Method or Function"). In this instance, SAP NetWeaver Visual Composer fails to perform sufficient authorization checks within certain portal functionality. The core weakness is an authorization boundary failure: a function or operation that should be restricted to privileged or administrative contexts is reachable by a low-privileged authenticated user.

The attack surface is the Visual Composer portal, which is intended to expose modeling/composition functionality to its users. According to the NVD description, the flaw permits an attacker with low privileges to "invoke internal operations on a preconfigured remote system." This indicates the affected portal functionality acts as a proxy or gateway: a server-side component within the NetWeaver portal can dispatch operations to another, preconfigured remote system. Because authorization checks on the portal side are inadequate, a low-privileged user can reach operations that were only meant to be triggered by trusted internal callers or higher-privileged users.

Two factors elevate severity:

1. The "preconfigured remote system" connection: the portal already holds the credentials/trust relationship needed to reach the remote system. The attacker leverages that pre-existing trust rather than obtaining their own credentials to the remote target.
2. "Depending on the remote connection configuration": impact is configuration-dependent. Where the remote connection is highly privileged (for example, a connection with administrative rights on the remote system), successful invocation of internal operations inherits that privilege, resulting in full compromise of the remote system.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms: network-reachable, low attack complexity, low privileges required, no user interaction, and Changed scope — meaning the vulnerable portal component can affect resources beyond its own security authority (i.e., the remote system). This Changed-scope rating is the strongest signal that the portal's compromised authority propagates to the remote target.

The provided data does not enumerate affected product versions, specific portal endpoints, function names, or parameters. No code-level detail is available, and none is fabricated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the NVD description and the CWE-749 class. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification: The attacker identifies a reachable SAP NetWeaver Visual Composer portal. Using the Shodan-style fingerprints above (Visual Composer page titles, SAP NetWeaver HTTP titles, exposed SAP ports), the attacker confirms the presence of the portal. The attacker then obtains low-privileged credentials — for example, any standard portal user account.

2. Triggering the flaw: Once authenticated with low privileges, the attacker navigates the Visual Composer portal functionality that is intended to invoke operations on a preconfigured remote system. The insufficient authorization check (CWE-749) allows the low-privileged user to reach and invoke internal operations that the portal was meant to reserve for trusted/higher-privileged callers. At the vulnerability-class level, this is a missing authorization control on a dangerous, externally reachable method — the low-privilege user is not properly blocked from an operation the portal is willing to perform.

3. Execution method (class level): The attacker does not necessarily need malicious payloads; the portal itself performs the privileged operation against the preconfigured remote system, using the trust/credentials already stored in the portal's connection configuration. The "payload" is the abuse of the portal's own trusted channel to the remote system.

4. Post-exploitation impact: Depending on the remote connection's configuration, invoked internal operations may execute with the privileges the portal holds on the remote system. If that connection is highly privileged, this leads to full compromise of the remote system — reading and modifying data (High confidentiality/integrity impact) and disrupting availability (High availability impact), consistent with the Changed-scope CVSS rating.

Because no exploit code, Nuclei template, or PoC exists in the provided data, exploitation is not yet commodity; however, the low complexity and low privilege requirement make weaponization feasible for a motivated attacker.

Impact Assessment

Business impact is high. SAP NetWeaver is a core enterprise platform hosting business-critical applications and data; a compromise of a "preconfigured remote system" reachable from the portal can expose downstream systems that trust the portal. The CVSS base score of 9.9 reflects: network attack vector (reachable remotely), low attack complexity (no specialized conditions), low privileges required (any low-privileged authenticated user), no user interaction, and Changed scope — the vulnerable component's compromise affects the remote system's confidentiality, integrity, and availability, each rated High.

Blast radius is configuration-dependent but potentially severe: a single low-privileged account could pivot from the portal to a fully compromised backend remote system. Affected systems are SAP NetWeaver installations running Visual Composer portal functionality configured with remote-system connections. Because the local scope is Changed, defenders should treat the remote systems behind the portal as in-scope for compromise, not just the portal host. There is no CISA KEV listing and no known in-the-wild exploitation in the provided data, but the severity warrants urgent triage.

Detection Guidance

Sigma Rule

title: Suspicious SAP NetWeaver Visual Composer Internal Operation Invocation
id: 3f2a9c14-8b7d-4e21-9c5a-1a2b3c4d5e6f
status: experimental
description: Detects low-privileged invocation of internal operations via the SAP NetWeaver Visual Composer portal that may indicate CVE-2026-89110 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89110
author: valtersit.com
logsource:
  product: sap
  service: netweaver
detection:
  selection_portal:
    cs-uri-stem|contains:
      - '/irj/portal'
      - '/VisualComposer'
      - '/vc/'
  selection_operation:
    cs-uri-query|contains|all:
      - 'operation'
  selection_suspicious_user:
    sc-status: 200
  condition: selection_portal and selection_operation and selection_suspicious_user
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate high-privileged administrative activity
  - Normal Visual Composer model deployment by authorized developers
level: high

YARA Rule

rule CVE_2026_89110_SAP_VisualComposer_AuthzBypass
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of suspicious SAP NetWeaver Visual Composer internal operation invocation (CVE-2026-89110)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89110"
        date = "2026-01-01"
        severity = "high"

    strings:
        $vc1 = "VisualComposer" nocase
        $vc2 = "Visual Composer" nocase
        $op1 = "operation=" nocase
        $op2 = "internaloperation" nocase
        $sap1 = "com.sap." nocase
        $sap2 = "NetWeaver" nocase

    condition:
        (2 of ($vc1, $vc2, $sap2)) and (1 of ($op1, $op2)) and (1 of ($sap1, $sap2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-89110 SAP NetWeaver Visual Composer Possible Authorization Bypass"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/VisualComposer"; nocase; http.uri; content:"operation"; nocase; http.header; content:"Cookie"; nocase; reference:cve,2026-89110; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-89110; classtype:attempted-admin; sid:202689110; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where user.name != null and event.outcome == "success" ]
  [ network where process.name == "java" and
      url.path : ("*VisualComposer*", "*visualcomposer*") and
      url.query : ("*operation*", "*internal*") and
      http.response.status_code == 200 ]

Splunk SPL Query

index=sap sourcetype="sap:netweaver:access"
| search (uri_path="*VisualComposer*" OR uri_path="*Visual Composer*" OR uri_path="*/irj/portal*")
| search (uri_query="*operation*" OR uri_query="*internal*")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(clientip) as src_ips by user
| where count > 0
| eval risk="low-priv user invoking internal VC operation - possible CVE-2026-89110"
| table user src_ips paths count first_seen last_seen risk

Wazuh OSSEC Rule

<group name="sap,netweaver,web,">
  <rule id="100891" level="12">
    <if_sid>31100</if_sid>
    <url>VisualComposer|Visual Composer|/irj/portal</url>
    <match>operation|internal</match>
    <description>CVE-2026-89110: Possible SAP NetWeaver Visual Composer authorization bypass - low-privileged user invoking internal operation.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_89110,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (given no patch):

• Restrict network access to the SAP NetWeaver Visual Composer portal to trusted networks/principals only (VPN, allow-listing), reducing the exposed attack surface.
• Review and harden the configuration of any "preconfigured remote systems" used by Visual Composer. Reduce the privileges of those remote connection credentials to the minimum required, so that even if internal operations are invoked, impact is bounded (the description explicitly notes impact is configuration-dependent).
• Enforce least privilege on portal accounts; audit for low-privileged accounts that can reach Visual Composer functionality and disable those that do not require it.
• Apply strict monitoring (see Detection Guidance) for low-privileged accounts invoking internal operations.

2. Patch / upgrade steps:

• No fixed version or SAP Security Note reference is available in the provided intelligence. Monitor SAP Security Notes and the SAP Product Security Center for the corresponding advisory and fixed release, and apply it as soon as published.
• Subscribe to SAP security patch notifications so the corresponding note is actioned immediately upon release.

3. Long-term hardening:

• Implement robust server-side authorization checks governing portal-to-remote-system operations (addressed by the vendor fix when available).
• Adopt defense-in-depth: network segmentation between the portal tier and backend remote systems, strong authentication, and auditing of privileged remote connections.
• Periodically review all "preconfigured remote system" connections for excessive privilege and unnecessary trust relationships.

References

• NVD — CVE-2026-89110: https://nvd.nist.gov/vuln/detail/CVE-2026-89110
• SAP Product Security Center (SAP Security Notes): https://www.sap.com/products/security.html (vendor advisory expected; no note mapped in provided data)
• CWE-749 — Exposed Dangerous Method or Function: https://cwe.mitre.org/data/definitions/749.html
• FIRST EPSS (not yet scored for this CVE; monitor): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available in the provided data. No threat actor campaign or exploit-in-the-wild evidence has been identified or corroborated; CVE-2026-89110 is not listed in CISA KEV.