SAP NetWeaver Portal CVE-2026-89122

Exploitation requires the victim to click an attacker-crafted link targeting the vulnerable portal component (UI:R), so it is not self-propagating and cannot be triggered without human interaction. No authentication is required of the attacker (PR:N), but the attack delivers value only when a user visits the malicious URL within the context of a reachable SAP NetWeaver Enterprise Portal instance - internet-exposed or phishing-reachable portals are the realistic exposure. The limiting factors are: mandatory user interaction, dependence on social-engineering delivery, and impact confined to content spoofing/defacement and user-information tracking (no availability impact and no direct server compromise).

This is a moderate-severity, user-interaction-dependent client-side flaw rather than a server-compromising vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) is the canonical signature of a reflected content-injection/XSS-style issue: network-reachable and unauthenticated, but requiring a victim to click an attacker-crafted link (UI:R), with scope change (S:C) because the trusted portal renders attacker content in the victim's browser. Impact is limited to Low confidentiality and Low integrity with no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation signals point to opportunistic/targeted phishing-style abuse rather than mass automated exploitation. Note a data tension worth verifying: the CWE is CWE-601 (Open Redirect) and the tag reads 'Open Redirect,' yet the description ('loads attacker-controlled content within the trusted application context,' 'deface parts of the rendered page') reads more like content spoofing / reflected cross-site scripting than a pure redirect - verify the precise class with SAP note 3790401. Overall this is a real but lower-priority issue: prioritize patching on internet-exposed portals, but it is not a drop-everything critical given the required user interaction and limited impact.

An attacker crafts a malicious URL pointing at the vulnerable SAP NetWeaver Enterprise Portal component and delivers it via phishing or a chat/email link. When an authenticated or unauthenticated victim clicks it, attacker-controlled content is loaded and rendered inside the trusted portal context, letting the attacker spoof/deface page elements and harvest user information. No public exploit code was identified at time of analysis, and successful exploitation depends entirely on the victim interacting with the crafted link.