CVE-2026-89120: CWE-1188: Initialization of a Resource with an Insecure Default in SAP_SE SAP ABAP Platform

This vulnerability (CVE-2026-89120) in SAP ABAP Platform 9.16 involves a regression due to an API change that reintroduced an authorization weakness previously fixed. Specifically, the session manager can be accessed in single transaction mode, including from the FLP interface. A low-privileged attacker could exploit this flaw by sending specially crafted requests to bypass authorization restrictions. The vulnerability affects the integrity of the system significantly, with limited confidentiality impact and no availability impact. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, and low privileges required.

An attacker with low privileges can bypass authorization restrictions, leading to a high impact on system integrity. Confidentiality impact is low, and there is no impact on availability. This could allow unauthorized modification or manipulation of data or system state within the SAP ABAP Platform 9.16 environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor SAP advisories for updates and apply any official patches once available. Until then, restrict access to affected components and monitor for suspicious activity related to session manager usage.