SAP Gateway broken access control lets unauthenticated attackers act as internal application server (CVE-2026-89103)

What happened

SAP Gateway activates a default Access Control List with high privileges. This can cause an external attacker with network access to be categorised as an internal application server. The CVE record classifies the weakness as broken access control (CWE-863).

The result is that an unauthenticated attacker with network access to SAP Gateway could potentially perform unauthorised actions within the application environment. The CVSS 3.1 vector is network, low attack complexity, no privileges required, no user interaction, with changed scope and high impact on confidentiality, integrity and availability (CVSS score 10, critical). The CVE record does not state that this has been exploited or publicly disclosed.

Who is affected

SAP lists SAP Gateway as affected. The affected versions are KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 8.04, KERNEL 7.22, 7.54 and 7.77. Because the attack requires only network access without credentials, any SAP Gateway reachable from the internet or an untrusted network segment should be considered exposed. No fixed version or workaround is listed in the CVE record.

What to do now

1. Restrict network access to SAP Gateway before anything else: remove internet-facing exposure, place the service behind a VPN or jump host, and segment it from untrusted zones.
2. Inventory SAP Gateway instances against the affected versions above so the team knows which systems are in scope.
3. Monitor SAP's security note and the SAP Security Patch Day page for any fixed version or workaround. SAP has not published a fixed version or workaround for this CVE, so retain the network restrictions while no fix is listed.

How to detect it

No vendor indicators of compromise are published. Start with network exposure discovery: identify any SAP Gateway reachable from the internet or untrusted network segments, and review firewall rules and access logs for connection attempts from unexpected sources.

Beyond the patch

This is a network-reachable, unauthenticated issue in an SAP estate, so exposure management matters more than usual while no fix is listed. Virtual CISO Services helps find and close exposed services such as an internet-facing SAP Gateway. SAP HANA Security & Cloud Migration brings our SAP security practice to reviewing the wider estate. Supply Chain Defense & Third-Party Risk tracks the vendor's patch cycle so the organisation knows its exposure window.