Answer in brief
CVE-2026-89103 records a Critical severity (CVSS 10.0) vulnerability in Broken Access Control in SAP Gateway. The current sources do not mark it as known exploited. The current feed maps SAP_SE/SAP Gateway (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 10.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SAP_SE/SAP Gateway (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SAP_SE/SAP Gatewaygeneric | KRNL64NUC 7.22 || 7.22EXT || KRNL64UC 7.22 || 7.53 || 8.04 || KERNEL 7.22 || 7.54 || 7.77 || 7.93 || 9.16 || 9.20 || 9.21 | Not reported |
Published upstream
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 10, 2026
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Quoted source text, attributed separately from HOL analysis.