CVE-2026-89110 · CVSS 3.0 9.9 · SAP Note 3797111
SAP’s October Visual Composer fix concerns the trust placed in configured backend connections. A user with low privileges could call internal operations on a remote system through portal functionality. How far that access goes depends on the connection configuration; SAP warns that the remote system could be fully compromised.
Why the backend connection changes the risk
Note 3797111 is HotNews with a CVSS 3.0 score of 9.9. The attack is network-accessible, needs authentication and does not require another user’s interaction. SAP identifies RFC, BAPI and data services in the note. For triage, establish which backend destinations Visual Composer can reach and what permissions those connections carry. The exposure assessment needs both the portal and backend owners.
The change SAP made
An existing security configuration was not enabled by default. The correction changes the relevant default. The affected component is VC70RUNTIME 7.50. The patch table lists SP30/PL1, SP31/PL1, SP32/PL2, SP33/PL1, SP34/PL1, SP35/PL1 and SP36/PL1, with PL0 entries for SP37 and SP38. Select the package for the installed support-package branch and check FAQ 3797831 before rollout.
Patch analysis: SecurityMode is enabled by default
We compared VC70RUNTIME 7.50 SP36 PL0 with SP36 PL2. In com.sap.visualcomposer/WEB-INF/portalapp.xml, the VCBrokerConfiguration service profile changes one security setting:
<!-- Before -->
<property name="SecurityMode" value="false"/>
<!-- After -->
<property name="SecurityMode" value="true"/>The check that this setting controls was already present. ExecuteFunctionService.class is byte-for-byte identical in the two API JARs. This supports SAP’s explanation that the correction enables an existing protection by changing its default.
What the existing check does
In ExecuteFunctionService.doService(), the secure-mode branch reads the model component profile property com.sap.portal.iview.WhiteList. It compares the requested data-service function with the entries in that list and returns an error when there is no match. That check sits before the call to BackEndBroker.executeDataService(). With the default set to false, this model-level function check is skipped on the normal execution path.
The distinction matters: a user being allowed to open a portal application does not make every operation available through its backend connection appropriate for that application. Secure Mode introduces the model’s permitted-function list at that boundary. The nearby enableXSRFProtection setting is already true in both packages; this configuration change concerns function access, while the existing XSRF check remains in place.
The inspected connector code passes the current portal user and the selected system alias to the destination service. The resulting backend identity and permissions therefore depend on destination and user-mapping configuration. The diff establishes the missing model-level restriction; it does not establish that every installation provides an unrestricted administrator connection.
What this comparison can establish
These findings come from static inspection of the supplied archives and decompiled code, without an exploitation test. The comparison spans PL0 to PL2; SAP Note 3797111 lists SP36 PL1 as the correction level for that branch. PL2 is the package examined here, not a revised minimum requirement. Other differences in these cumulative packages should not automatically be attributed to CVE-2026-89110.
After deployment, check the effective runtime value of SecurityMode and exercise the Visual Composer models used by the business. Their permitted-function lists need to contain the legitimate data services they call. Keep the SAP patch matrix and the documented restart procedure as the deployment reference; editing an archive descriptor alone is not the documented rollout procedure.
Secure Mode is the documented interim measure
SAP points administrators to its Setting Secure Mode instructions as a temporary workaround. The note also requires a manual restart of the com.sap.visualcomposer application in NetWeaver Administrator after applying those settings. Plan for that restart and verify dependent applications. Merely changing a setting without the restart leaves the documented procedure incomplete.
Close the change with backend evidence
After patching, check legitimate Visual Composer data-service use with the expected business roles. Keep an inventory of the destinations and their authorization scope with the change record. Treat reduced backend privileges as useful exposure reduction, while still implementing the SAP correction. The note’s severity reflects a possible crossing into a different system; a portal-only patch checklist can miss that operational context.
Advisory details
Component: EP-VC-RTM
SAP priority: HotNews
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3797111 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
