What is CVE-2026-89110?
CVE-2026-89110 is a broken access control vulnerability in SAP NetWeaver Visual Composer, classified as CWE-749, Exposed Dangerous Method or Function. Certain portal functionality does not perform sufficient authorization checks, and a low-privileged attacker can use it to invoke internal operations on a preconfigured remote system.
The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical), with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Attack vector is network, attack complexity is low, and no user interaction is required. Confidentiality, integrity, and availability impacts are all rated high.
Two elements of that vector carry most of the weight. The first is scope, which is rated changed. The damage does not land on the portal. It lands on whatever system the portal’s destination points at, which in a NetWeaver landscape is typically an ERP, finance, or supply chain back end that the portal has been configured to reach. SAP’s own wording is that depending on the remote connection configuration, this could lead to a full compromise of the remote system.
The second is privileges required, rated low. This is not an unauthenticated flaw, and that difference matters when prioritising. It matters less than it first appears, though, because the privilege in question is an ordinary portal account. Enterprise portals routinely hold large user populations reached through employee SSO, supplier and partner logins, or self-service registration, so the set of accounts that satisfy this precondition is usually much larger than the set of administrators.
Visual Composer also has recent history. CVE-2025-31324, a missing authorization check in the same component, was added to CISA’s Known Exploited Vulnerabilities catalog after being exploited in the wild. That does not make this flaw exploited, and no exploitation has been reported at publication, but it does establish that attackers have already built tooling and familiarity around this specific part of the NetWeaver Java stack.
What assets are affected by CVE-2026-89110?
The affected software component is VC70RUNTIME 7.50, the Visual Composer runtime shipped with the SAP NetWeaver Java application server. SAP has published the fix through security note 3797111 as part of the October 2026 Security Patch Day.
Scoping this accurately requires three facts that only the operator holds. The first is whether the system runs the NetWeaver Java stack at all, since Visual Composer does not exist on the ABAP stack. The second is whether the Visual Composer runtime is actually deployed and active on that Java stack, which varies by landscape and by how the portal was originally built out. The third is how the portal’s remote destinations are configured, because the destination configuration is what determines whether this is a contained authorization bug or a route into a production ERP system.
That third point is worth dwelling on. The severity of this vulnerability is not a property of the portal. It is a property of what the portal is wired to, and with what credentials. Two organizations running the identical patch level can face materially different consequences depending on whether their destinations use narrowly scoped service accounts or broadly privileged ones.
In practice an affected asset is an internet-facing SAP enterprise portal, the kind deployed to give employees, suppliers, or customers browser access to back-office processes. These systems are externally reachable by design, which removes the usual question of accidental exposure and replaces it with a question about which internal systems sit one destination hop behind them.
Externally, none of the three scoping facts is visible. A scan identifies NetWeaver. It does not identify the stack, the component, or the destination configuration.
What does our data show about exposure patterns?
Exposure in this set is led by Communication Services at 34.31% of observed assets, with Information Technology at 30.96% and Consumer Staples at 14.64%. The remaining sectors together account for 20.08%.
That ordering is unusual for an enterprise application and is worth reading with care. It does not say that media companies run more SAP than manufacturers do. It says that in this particular set, a small number of very large estates dominate, and the largest of them happens to sit in Communication Services. The Information Technology share has a similar explanation, driven by global IT services firms that operate SAP landscapes on behalf of their own clients.
Concentration is high. The largest single estate alone accounts for roughly a third of the observed assets, and adding the next largest takes it past half. Sector shares under that much concentration describe the deployment choices of a very few large organizations more than they describe an industry.
Geographically the set is firmly European and German-led, with Germany holding close to two in five of the observed assets. The United States, the Netherlands, Italy, Denmark, Belgium, and Austria follow. That footprint is what a mature European SAP installed base looks like, and it tracks the vendor’s home market and the concentration of long-established industrial and consumer groups that have run NetWeaver portals for decades.
The version evidence is thin to the point of being unusable on its own. Every observed asset is a fingerprint-level identification, and only around one in fourteen carries any version string at all. Among those few, most read 7.53 rather than the 7.50 named in the advisory, which is a release indicator rather than confirmation of the Visual Composer component level. External data can establish that NetWeaver is running. It cannot establish that VC70RUNTIME 7.50 is deployed.
One signal does narrow the field, and it is the one defenders should act on first. Where a port is recorded, it clusters on 50000, 50001, 50100, and 50300, the standard listener range for the SAP Java application server. Visual Composer exists only on the Java stack, so a Java-stack port is the closest external corroboration available for this specific component. That signal appears on only a small minority of the records, which means the discriminator that matters most is also the one most often missing.
The practical consequence is that this is an advisory where external visibility sets the agenda and internal data closes it. Reachable NetWeaver assets are findable from outside. Which of them run Java, run Visual Composer, and hold privileged destinations is a question for the Basis team, and that question is the one that determines actual risk.
Are fixes available?
Yes. SAP has released the fix in security note 3797111, published as part of the October 2026 Security Patch Day. Customers apply it through the standard SAP support note process, and the note itself carries the applicable support package and patch guidance for the VC70RUNTIME component.
SAP has published no workaround in the CVE record. Where patching cannot happen immediately, the available risk reduction lies in the destination configuration rather than in the portal itself. Reviewing which remote systems the portal can reach, and with what privilege level those destinations authenticate, directly limits what a successful exploitation of this flaw can reach. That is a worthwhile exercise regardless of patch timing, because it constrains this vulnerability and the next one in the same class.
Restricting portal account provisioning is the other lever. Because the flaw requires a low-privileged account rather than none, tightening who holds an active portal login, and removing dormant supplier, partner, and former employee accounts, reduces the population that meets the precondition.
Are there any other recommended actions to take?
Until patching is confirmed, defenders should:
- Inventory every internet-facing SAP NetWeaver system and record whether each runs the ABAP stack, the Java stack, or both
- Confirm for each Java stack system whether the Visual Composer runtime is deployed and active
- Prioritise systems presenting listeners in the standard SAP Java application server port range
- Review every portal destination for the privilege level of the account it authenticates with, and reduce it where it exceeds what the integration needs
- Audit active portal accounts and disable dormant employee, supplier, and partner logins
- Apply SAP security note 3797111 through the normal support package process
- Review portal logs for unexpected invocation of internal operations by non-administrative accounts
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for CVE-2026-89110 in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
