CVE-2026-89110 · CVSS 3.0 9.9 · SAP Note 3797111
SAP’s October Visual Composer fix concerns the trust placed in configured backend connections. A user with low privileges could call internal operations on a remote system through portal functionality. How far that access goes depends on the connection configuration; SAP warns that the remote system could be fully compromised.
Why the backend connection changes the risk
Note 3797111 is HotNews with a CVSS 3.0 score of 9.9. The attack is network-accessible, needs authentication and does not require another user’s interaction. SAP identifies RFC, BAPI and data services in the note. For triage, establish which backend destinations Visual Composer can reach and what permissions those connections carry. The exposure assessment needs both the portal and backend owners.
The change SAP made
An existing security configuration was not enabled by default. The correction changes the relevant default. The affected component is VC70RUNTIME 7.50. The patch table lists SP30/PL1, SP31/PL1, SP32/PL2, SP33/PL1, SP34/PL1, SP35/PL1 and SP36/PL1, with PL0 entries for SP37 and SP38. Select the package for the installed support-package branch and check FAQ 3797831 before rollout.
Secure Mode is the documented interim measure
SAP points administrators to its Setting Secure Mode instructions as a temporary workaround. The note also requires a manual restart of the com.sap.visualcomposer application in NetWeaver Administrator after applying those settings. Plan for that restart and verify dependent applications. Merely changing a setting without the restart leaves the documented procedure incomplete.
Close the change with backend evidence
After patching, check legitimate Visual Composer data-service use with the expected business roles. Keep an inventory of the destinations and their authorization scope with the change record. Treat reduced backend privileges as useful exposure reduction, while still implementing the SAP correction. The note’s severity reflects a possible crossing into a different system; a portal-only patch checklist can miss that operational context.
Advisory details
Component: EP-VC-RTM
SAP priority: HotNews
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3797111 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
