SAP NetWeaver Visual Composer CVE-2026-89110

Exploitation requires a valid low-privileged authenticated session on the SAP NetWeaver portal (PR:L - not anonymous), and the environment must have a preconfigured remote system/destination reachable through Visual Composer portal functionality. The attacker leverages missing authorization checks to invoke internal operations against that destination. The degree of impact is bounded by the remote connection configuration - full compromise occurs only where the configured connection is highly privileged; environments with narrowly-scoped or least-privilege remote destinations face reduced impact. No user interaction is required and the vector is network-reachable, but the dependency on both low-level credentials and an existing privileged remote destination are the key limiting factors.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) is internally consistent with the description: network-reachable, low attack complexity, only low privileges required, no user interaction, and a scope change that carries impact from the NetWeaver portal onto a separate preconfigured remote system. The near-maximum score is driven primarily by the scope change (S:C) plus full C/I/A impact, which is credible for an authorization-bypass flaw that lets a low-privileged user invoke internal operations on a trusted downstream system. Tempering signals: no EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit (POC) was provided, so there is no public exploit identified at time of analysis - meaning the 9.9 reflects potential impact rather than confirmed mass exploitation. One caveat to verify: the worst-case 'full compromise of the remote system' is explicitly conditional ('Depending on the remote connection configuration'), so actual impact in a given environment may be lower than the headline score where remote destinations are minimally privileged. The single input tag 'Information Disclosure' understates the issue - CWE-749 and the I:H/A:H impact describe an authorization bypass enabling full compromise, not merely data exposure.

A low-privileged user with access to the SAP NetWeaver portal abuses missing authorization checks in Visual Composer to invoke internal operations that are proxied to a preconfigured trusted remote system. Because the portal performs the action under its own trusted connection, the attacker can reach and act on the backend system beyond their authorization level; where that remote connection is highly privileged, this escalates to full compromise of the remote system. No public exploit code was identified at the time of analysis, and exploitation requires valid (low-level) portal credentials.