SAP ABAP Platform: API Regression Reintroduces Authorization Weakness
CVE-2026-89120 Published on October 13, 2026
Missing authorization check in SAP ABAP Platform
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.
Vulnerability Analysis
CVE-2026-89120 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
Insecure Default Initialization of Resource
The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
Products Associated with CVE-2026-89120
Want to know whenever a new CVE is published for SAP Abap Platform? stack.watch will email you.
Affected Versions
SAP_SE SAP ABAP Platform:- Version KERNEL 7.93 is affected.
- Version 9.16 is affected.