Detections
Analytics
SAP NetWeaver Multiple Vulnerabilities (3804858)
critical Nessus Plugin ID 379590
Synopsis
The remote SAP NetWeaver application server is affected by multiple vulnerabilities.Description
The version of the SAP NetWeaver kernel detected on the remote host is affected by multiple vulnerabilities as referenced in SAP Security Note 3804858:- SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
(CVE-2026-89119)
- SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability. (CVE-2026-120014)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate patch according to the vendor advisory.See Also
Plugin Details
Severity: Critical
ID: 379590
File Name: sap_netweaver_kernel_3804858.nasl
Version: 1.1
Type: Remote
Family: Web Servers
Published: 11/12/2026
Updated: 11/12/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 92.79
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-89119
CVSS v3
Risk Factor: Critical
Base Score: 9.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:sap:netweaver_application_server
Required KB Items: Settings/ParanoidReport, installed_sw/SAP Netweaver Application Server (AS)
Patch Publication Date: 11/10/2026
Vulnerability Publication Date: 11/10/2026