{"id":3107,"date":"2026-11-10T08:11:30","date_gmt":"2026-11-10T16:11:30","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=3107"},"modified":"2026-11-10T08:12:49","modified_gmt":"2026-11-10T16:12:49","slug":"emerging-threat-cve-2026-89103-sap-gateway-authentication-bypass-via-default-access-control-list","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-89103-sap-gateway-authentication-bypass-via-default-access-control-list\/","title":{"rendered":"Emerging Threat: (CVE-2026-89103) SAP Gateway Authentication Bypass via Default Access Control List"},"content":{"rendered":"
\n
\"\"
Sample of assets impacted by SAP Gateway Authentication Bypass vulnerability, identified by the CyCognito Platform<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

What is CVE-2026-89103?<\/strong><\/h2>\n\n\n\n

CVE-2026-89103 is a broken access control flaw in SAP Gateway, caused by the gateway activating a default access control list (ACL) with high privileges. Under that default, an external attacker can be categorized as an internal application server.<\/p>\n\n\n\n

The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical). It is classified as CWE-863 (Incorrect Authorization).<\/p>\n\n\n\n

Exploitation is pre-authentication. An attacker needs only network access to the gateway, and no user interaction is required.<\/p>\n\n\n\n

The gateway’s ACLs decide which external programs may connect and which programs may be started. An attacker accepted as an internal application server can perform unauthorized actions within the SAP environment, with high impact on confidentiality, integrity, and availability. Published analysis notes that this opens the gateway paths commonly used for command execution.<\/p>\n\n\n\n

What assets are affected by CVE-2026-89103?<\/strong><\/h2>\n\n\n\n

The flaw sits in the gateway service that ships with the SAP kernel. Affected releases include KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, 7.53, and 8.04, and KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.20, and 9.21. Public sources group some of these versions differently, so SAP Security Note 3798345 is the authoritative list.<\/p>\n\n\n\n

In practice, an affected asset is an SAP NetWeaver application server, or another SAP system built on the kernel, whose gateway port is reachable. The gateway typically listens on TCP\/33NN, where NN is the instance number, and on TCP\/48NN for secured connections.<\/p>\n\n\n\n

Sources differ on how much configuration is needed for exposure. One reading holds that the vulnerable state is the shipped default. Another holds that exposure depends on secinfo and reginfo holding no explicit rules, or relying on the internal host keyword.<\/p>\n\n\n\n

Gateway ports are meant for system-to-system traffic. They tend to stay reachable on hosting and partner-facing networks, in landscapes run by service providers, and on systems left in place after migrations.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/strong><\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Exposure in this set is led by Information Technology at 26.4% of observed assets, with Communication Services contributing 26.0%. Industrials follow at 13.7%, and Consumer Staples, within Others, is close behind at 12.3%.<\/p>\n\n\n\n

The Information Technology share reflects IT service providers that host and operate SAP landscapes, often across many client environments and data centers. The Communication Services share reflects large, centrally run SAP estates, where a single landscape can carry many internet-reachable application servers.<\/p>\n\n\n\n

The cross-sector spread points to a common driver: SAP application servers reachable from untrusted networks, with ports intended for internal system-to-system traffic left open. These assets were predominantly identified by service fingerprint as running SAP NetWeaver, rather than by confirmed version or configuration detection, so they should be treated as potentially affected until verified.<\/p>\n\n\n\n

Are fixes available?<\/strong><\/h2>\n\n\n\n

Yes. SAP released a correction in SAP Security Note 3798345 on its November 2026 Security Patch Day. The note requires an SAP for Me login to view.<\/p>\n\n\n\n

The fix is delivered as a kernel update. Published analysis indicates it introduces the gw\/acl_mode_proxy profile parameter on older kernels, which may need to be set after patching. Sources disagree on whether SAP documents an interim workaround.<\/p>\n\n\n\n

The vulnerability is not listed in CISA KEV, and active exploitation has not been reported at the time of writing. Defenders should confirm the required kernel level and any post-patch configuration steps directly in the SAP note rather than assuming a kernel update alone closes the issue.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/strong><\/h2>\n\n\n\n

Until patching is confirmed, defenders should:<\/p>\n\n\n\n