CVE-2026-89117 · CVSS 3.0 6.1 · SAP Note 3779985
SAP Note 3779985 addresses a URL parameter reflected into an Enterprise Portal response without adequate encoding. An attacker can prepare the URL without a portal account. Exploitation occurs when another user visits it and the resulting script runs in that user’s browser.
The browser is the affected context
SAP describes exposure of session information, changes to rendered portal content and user redirection. CVE-2026-89117 is rated 6.1, Medium priority, with low confidentiality and integrity impacts and no availability impact. It should not be described as unauthenticated server-side code execution merely because the attacker can construct the link without signing in.
Patch EP-ADMIN, not only EP-RUNTIME
The listed component is EP-ADMIN 7.50. SAP’s patch table specifies SP30/PL2, SP31/PL3, SP32/PL3, SP33/PL1, SP34/PL2, SP35/PL2 and SP36/PL1, with PL0 entries for SP37 and SP38. The fix encodes the request parameters reflected in page markup.
Keep the portal components distinct
October also includes fixes for EP-RUNTIME. A deployment record that says only “portal patched” is too broad to confirm this finding. Record the installed EP-ADMIN patch and test ordinary portal links and navigation after the update. Review component coverage across cluster nodes so that a request cannot still reach an instance running the older administration component.
Advisory details
Component: EP-PIN-URL
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3779985 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
