SAP Web Dispatcher and Internet Communication Manager CSRF flaw could allow OS compromise (CVE-2026-89119)

What happened

CVE-2026-89119 is a cross-site request forgery weakness in certain administrative functionality of SAP Web Dispatcher and the Internet Communication Manager in SAP NetWeaver Application Server ABAP. The CVE record states that these components do not perform sufficient request validation, so an unauthenticated attacker can prepare a malicious link. If a logged-on administrator visits that link, the browser can carry out unintended actions in the administrator's session.

The CVSS 3.1 vector has a base score of 9.6, severity critical. The attacker needs no credentials, but must convince an administrator to click. The CVE record describes successful exploitation as potentially leading to full compromise of the underlying operating system, with high impact on confidentiality, integrity and availability.

The CVE record does not report public disclosure or active exploitation, and it is not listed in CISA's KEV catalogue.

Who is affected

The affected list covers SAP Web Dispatcher and Internet Communication Manager versions WEBDISP 7.93 and 9.16, XS_ADVANCED_RUNTIME 1.00, and KERNEL 7.93, 9.20 and 9.21. These are web-serving and internet communication components for SAP ABAP environments, so teams running SAP Web Dispatcher or NetWeaver AS ABAP with Internet Communication Manager should check these versions against their landscape.

What to do now

1. Monitor the SAP security note and the SAP Security Patch Day page for updated remediation guidance. No fixed version or workaround is listed in the CVE record.
2. Restrict access to the administrative functionality of SAP Web Dispatcher and Internet Communication Manager to trusted management networks, and avoid exposing these interfaces directly to the internet.
3. Use separate browser profiles for administrative sessions, and avoid opening untrusted links or documents while logged into these consoles.
4. Review administrative and security logs for unexpected configuration or operating-system changes, especially around the time an administrator may have visited an untrusted link.

Beyond the patch

Although the flaw is network-reachable and requires no privileges under CVSS 3.1, the attacker still needs an administrator to click a link, so Managed Cyber Awareness Training is directly relevant until SAP publishes a fix. Virtual CISO Services can help review where the administration interfaces are reachable and whether that exposure is necessary.