NVD publishes unauthenticated SAP flaws, with no base scores yet

NVD published SAP-sourced entries on November 10 for flaws an unauthenticated attacker could reach over the network. NVD has not published base scores for the entries below. SAP SE assigned the vectors. None of the fetched pages lists a fix version, and none says the flaws are being exploited.

Web Dispatcher can be driven into memory corruption. CVE-2026-89126 says SAP Web Dispatcher does not sufficiently validate certain network input. An unauthenticated attacker could send crafted traffic to trigger memory corruption, and successful exploitation could allow arbitrary code and a full compromise. SAP SE lists it as a heap-based buffer overflow, CWE-122, and assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The NVD page shows affected versions including WEBDISP 7.53, 7.54 and 7.77, and says 12 versions are affected.

Gateway can treat an outsider as an internal server. CVE-2026-89103 says SAP Gateway activates the default access control list with high privileges, which can categorize an external attacker as an internal application server. An unauthenticated attacker with network access could perform unauthorized actions, with a high impact on confidentiality, integrity and availability. SAP SE lists incorrect authorization, CWE-863, and assigns the same vector as the Web Dispatcher flaw. The page shows versions including KRNL64NUC 7.22, KRNL64UC 7.22, 7.53 and 8.04, out of 12 listed.

A malicious link can ride an administrator session. CVE-2026-89119 covers SAP Web Dispatcher and the Internet Communication Manager in SAP NetWeaver Application Server ABAP. The entry says certain administrative requests are not validated enough. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in that session, and a successful attack could fully compromise the operating system. SAP SE lists cross-site request forgery, CWE-352, and assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Shown versions include WEBDISP 7.93 and 9.16, plus kernel builds 7.93 and 9.20.

Two more entries stop short of a full compromise. CVE-2026-89114 says the SAP NetWeaver AS Java EDM Application does not check authentication on certain web service requests. An unauthenticated attacker could retrieve sensitive business information. The entry says the impact is on confidentiality only. SAP SE assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and lists version CE-RA-EDM 7.50. CVE-2026-76973 says a memory corruption bug in the message server of SAP NetWeaver and ABAP Platform could let an unauthenticated attacker crash the server and disrupt active connections. Confidentiality and integrity are unaffected. SAP SE assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The page shows 13 affected versions, including KRNL64NUC 7.22 and KRNL64UC 7.53.

NVD's base score on each of these pages is still listed as not yet provided.