CVE-2026-89122 · CVSS 3.0 6.1 · SAP Note 3790401
A familiar portal address can lend credibility to an attacker-controlled page. CVE-2026-89122 concerns insufficient input validation in a NetWeaver Enterprise Portal component. A victim who follows a crafted link can load external content within the trusted application context.
A link-based attack with no attacker login
SAP assigns Medium priority and CVSS 6.1. The attacker does not need a portal account, but a victim must interact with the link. SAP describes user tracking and defacement of rendered content, with low confidentiality and integrity impacts and no availability impact. The advisory does not describe server-side code execution.
SAP removes the affected endpoint
The affected component is EP-RUNTIME 7.50. The correction removes the vulnerable endpoint entirely. SAP lists SP30/PL14, SP31/PL14, SP32/PL13, SP33/PL8, SP34/PL8, SP35/PL6 and SP36/PL2, plus PL0 entries for SP37 and SP38. Match the patch to the installed branch before scheduling deployment.
Include navigation in acceptance testing
Because the endpoint is removed, check custom portal navigation and embedded content that may depend on older portal behavior. That is a regression-testing recommendation, not a statement that all such customizations use the affected endpoint. Keep the component patch level and results with the change record. The same EP-RUNTIME patch levels appear in October’s separate information-disclosure note 3789825; track both findings even if one deployment delivers both corrections.
Advisory details
Component: EP-PIN-NAV
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3790401 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
