Vulnerability · Published Oct 13, 2026 · Assigned by sap

CVE-2026-89120Missing authorization check in SAP ABAP Platform

High 7.1

In plain English

A high-severity security flaw in SAP ABAP Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 85.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in high impact on integrity and low impact on confidentiality. There is no impact on availability.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP ABAP Platform	KERNEL 7.939.16

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

In plain English

Official description

Affected products (as reported)

References