Web Dispatcher and ICM Admin CSRF: CVE-2026-89119 · CVSS 3.0 9.6 · SAP Note 3804858
The Web Dispatcher and ICM administration UI (/sap/admin and /sap/wdisp/admin) can change the component’s configuration. Note 3804858 adds missing request validation to it. Without it, an attacker could get a logged-on administrator to open a crafted link. The link then triggers administrative actions in that session. According to SAP, this can lead to full compromise of the operating system. SAP rates the Web Dispatcher and ICM Admin CSRF at CVSS 9.6, HotNews. In this post, we cover exposure, the fix and what to check.
Web Dispatcher and ICM Admin CSRF: two CVEs
For the Web Dispatcher and ICM Admin CSRF, CVE-2026-89119 (9.6) covers standalone and embedded Web Dispatcher and the AS ABAP ICM. In addition, CVE-2026-120014 (7.6) covers the Web Dispatcher in HANA XS Advanced. There, however, the impact stays limited to that Web Dispatcher. AS Java and HANA XS Classic are not affected.
Are you affected
Only installations with the administration UI enabled through icm/HTTP/admin parameters qualify. Also, at least one user must have the admin role. So check the DEFAULT and instance profiles for icm/HTTP/admin_* entries. If none exist, or no user has admin, this issue does not apply.
Fix and workaround
Patch with SAPWEBDISP.SAR or the kernel (7.93, 9.16, 9.20, 9.21). Then update XSA to 1.5.5 or later (Note 3835748). As a workaround for the Web Dispatcher and ICM Admin CSRF, set icm/HTTP/admin_0 to empty and remove the other icm/HTTP/admin_x parameters. Alternatively, replace the admin role with monitor. Also see FAQ note 3810549 and general hardening note 3752223.
Reduce what is reachable
Even after the patch, the admin UI rarely needs to be reachable from user networks. Therefore, restrict it to an admin network, or switch it off where nobody uses it. That step also limits the impact of the Web Dispatcher and ICM Admin CSRF and of any similar future bug.
Web Dispatcher and ICM Admin CSRF: advisory details
Component: BC-CST-WDP
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: SAP Security Note 3804858 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
