CVE-2026-89110: SAP SE SAP NetWeaver Visual Composer

Critical severity, CVSS 9.9. EPSS: 0.3% chance of exploitation in the next 30 days.

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

Affected products

• SAP SE SAP NetWeaver Visual Composer

Published 2026-10-13. Last modified 2026-10-15.