critical2026-10-13SAP NetWeaver Visual ComposerCVE-2026-89110
Broken Access Control in Visual Composer Runtime
SAP NetWeaver Visual Composer
Our Take
Visual Composer is the component everyone forgot was installed. It is old, rarely monitored, and connected to backends. Find out whether you still run it before you argue about the patch window.
Vulnerability Detail
Users with limited privileges can reach a preconfigured backend system through Visual Composer and potentially compromise it. A temporary workaround exists but requires an application restart.
Patch Action
Apply SAP Note 3797111. If you cannot patch right away, check the note for the workaround and plan for the restart it requires. If you do not use Visual Composer, confirm whether it is deployed at all.
Affected Versions
VC70RUNTIME 7.50
Patch Info