CVE-2026-89110: CWE-749: Exposed Dangerous Method or Function in SAP_SE SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer contains a vulnerability identified as CVE-2026-89110 (CWE-749) due to insufficient authorization checks in specific portal functions. An attacker with low privileges can exploit this flaw to invoke internal operations on a remote system configured within the portal. Depending on the remote connection setup, this exploitation can result in complete compromise of the remote system. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute internal operations on a remote system, potentially leading to full compromise of that system. This results in high impact on confidentiality, integrity, and availability of the affected remote system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected portal functionality and monitor for suspicious activity related to remote system operations.