SAP Gateway Access Control: CVE-2026-89103 · CVSS 3.0 10.0 · SAP Note 3798345
The SAP Gateway decides who may register RFC servers and start external programs. For this decision, however, it largely trusts its own application servers. Note 3798345 addresses a weakness in the default access control list. Because of it, an unauthenticated attacker on the network could pass as one of those internal servers. Then, from there, the usual Gateway attack paths towards command execution open up. SAP assigns the SAP Gateway Access Control issue CVSS 10.0 and HotNews priority. In this post, we cover exposure, the fix and what to check.
SAP Gateway Access Control: why the default ACL matters
Sometimes no explicit secinfo and reginfo rules exist, or the rules rely on the internal host keyword. In that case, the Gateway falls back to rules that allow application servers of the same system. So, if an attacker makes the Gateway believe it is one of those hosts, the protection disappears. That is why this fix targets how the Gateway builds the default ACL rather than a single endpoint.
Correction
Specifically, the fix ships in the kernel for releases 7.22, 7.53, 7.54, 7.77, 7.93, 8.04 and 9.16 to 9.21. For kernels up to 7.77, it introduces the profile parameter gw/acl_mode_proxy, which tightens the default ACL rules. From 7.93 onwards, the parameter already exists. See SAP Note 3224889 for the parameter and FAQ note 3810197. Deploy through the SP Stack Kernel or the dw.sar hotfix. Unfortunately, SAP lists no workaround for the SAP Gateway Access Control weakness.
What to check
First, confirm that gw/acl_mode is 1 and that secinfo and reginfo contain explicit rules. Next, set gw/acl_mode_proxy after patching. In addition, check whether anyone can reach the Gateway port (33xx) from user networks or the internet. Finally, review Gateway logs for registrations from hosts outside the system’s own server list. Together, these steps close most SAP Gateway Access Control gaps, not just this CVE.
SAP Gateway Access Control: advisory details
Component: BC-CST-GW
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3798345 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
