{"affected":[{"defaultStatus":"unaffected","product":"SAP Gateway","source":"CNA: sap","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"8.04"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"cveId":"CVE-2026-89103","cwes":["CWE-863"],"description":"SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":10,"severity":"critical","source":"CNA: sap","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794269923492,"publishedAt":1794269923492,"references":[{"source":"CNA: sap","tags":[],"url":"https://me.sap.com/notes/3798345"},{"source":"CNA: sap","tags":[],"url":"https://url.sap/sapsecuritypatchday"}],"remediation":[],"revision":"86a12d4eb7d2b4b78da024dd430201d204cbab053887c901351eab596add871d","sources":[{"modifiedAt":1794269923492,"name":"CNA: sap","retrievedAt":1794272977269,"url":"https://www.cve.org/CVERecord?id=CVE-2026-89103"}],"ssvc":null,"status":"published","title":"Broken Access Control in SAP Gateway","updatedAt":1794272977269}