CVE-2026-89120 · CVSS 3.0 7.1 · SAP Note 3626303
A kernel API change brought back an authorization weakness that had already been fixed. SAP Note 3626303 addresses access to the session manager from single-transaction mode, including launches from Fiori Launchpad. A user with low privileges could get past the intended restriction.
What the regression exposes
SAP assigns CVSS 7.1 and High priority. The reported impact is high for integrity and low for confidentiality, with no availability impact. Exploitation is network-based, requires an authenticated low-privileged user and does not require victim interaction. The correction blocks unintended access to the Easy Access Menu.
Kernel 7.93 and 9.16
The affected-component table lists these two kernel releases. The correction entries are 7.93 patch 320 and 9.16 patch 11; SAP says later patch levels on the respective release also contain the fix. Use the current supported SP Stack Kernel when it includes the correction and review its regression note. SAP supplies the change through the kernel archives, including dw.sar for the hotfix route.
No workaround is listed
SAP provides no workaround for this issue. Test single-transaction launches, including the Fiori entry points used in your environment, after the kernel update. Acceptance should cover both normal business navigation and the restriction that prevents access to the broader session manager. Keep the running kernel version from every relevant application-server instance with the change record.
How this fits the October release
This entry was released on 13 October 2026 but appears under Support Package Security Notes in SAP for Me. It is included here alongside the monthly Patch Day notes so that the day’s high-priority kernel correction is not lost from the operational patch list.
Advisory details
Component: BC-ABA-SC
SAP priority: Correction with high priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 9
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Source: SAP Security Note 3626303 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
