Web Dispatcher WebSocket Memory Corruption: CVE-2026-89126 · CVSS 3.0 10.0 · SAP Note 3778556
SAP Web Dispatcher is usually the first SAP component an external request touches. For that reason, a pre-authentication memory bug there carries the most risk. Note 3778556 fixes a heap-based out-of-bounds write. Specifically, WebSocket control frames with invalid length fields trigger it during reassembly. An unauthenticated attacker could use the Web Dispatcher WebSocket Memory Corruption to execute code and take over the host. SAP rates it CVSS 10.0, HotNews. In this post, we cover exposure, the fix and what to check.
Web Dispatcher WebSocket Memory Corruption: scope
The Web Dispatcher WebSocket Memory Corruption affects standalone and embedded Web Dispatcher on kernel 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20. In addition, the Web Dispatcher in SAP HANA XS Classic and XS Advanced is affected. SAP Content Server, however, is not. SAP handles the same root cause in the ABAP ICM separately, in Note 3778530.
Patching paths
Use SAPWEBDISP.SAR for standalone Web Dispatcher. For embedded instances, use dw.sar or the SP Stack Kernel. HANA XSC needs the revision named in the note, SPS08 rev. 089.05 or SPS07 rev. 079.11. Meanwhile, XSA must run version 1.5.4 or higher. SAP collects questions about this issue in FAQ note 3778788.
Temporary option
You can switch off WebSocket support until the patch for the Web Dispatcher WebSocket Memory Corruption is in. However, SAP warns that this affects interactive and integration scenarios such as ABAP Push Channels and some Fiori features. So if you go that route, test it first and record it as a temporary change.
Inventory first
Above all, find every Web Dispatcher in the landscape. Small instances in front of HANA or third-party backends are easy to miss. Then patch each one, because a single forgotten instance keeps the Web Dispatcher WebSocket Memory Corruption open. Finally, verify the patch level of each instance in its admin page or in the startup log.
Web Dispatcher WebSocket Memory Corruption: advisory details
Component: BC-CST-WDP
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 13
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3778556 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
