{"metadata": {"vulnerability": "cve-2026-89103", "count": 17, "kinds": {"milestone": 4, "sighting": 8, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-10T22:24:03.822Z", "date_only": false, "value": "2026-09-10T22:24:03.822Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-89103", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T00:18:43.492Z", "date_only": false, "value": "2026-11-10T00:18:43.492Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-89103", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T00:18:43.492Z", "date_only": false, "value": "2026-11-10T00:18:43.492Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-89103", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T00:18:43.492Z", "date_only": false, "value": "2026-11-10T00:18:43.492Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / sap", "record": "cve-2026-89103", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T00:48:52.576Z", "date_only": false, "value": "2026-11-10T00:48:52.576062Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117589392233237666", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "67035f94-e7f4-4c5b-87b9-381e03fd6d27", "content": "CVE-2026-89103 Broken Access Control in SAP Gateway SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.\nhttps://www.cve.org/CVERecord?id=CVE-2026-89103https://me.sap.com/notes/3798345https://url.sap/sapsecuritypatchday#sap #SAP_SE #SAPGateway#CVE_2026_89103#bot", "url": "https://infosec.exchange/users/cve/statuses/117589392233237666"}, {"timestamp": "2026-11-10T01:17:21Z", "date_only": false, "value": "2026-11-10T01:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P6VW-54FJ-MJM4", "record": "GHSA-P6VW-54FJ-MJM4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T01:17:21.013Z", "date_only": false, "value": "2026-11-10T01:17:21.013", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89103", "record": "FKIE_CVE-2026-89103", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T01:17:21.013Z", "date_only": false, "value": "2026-11-10T01:17:21.013", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89103", "record": "FKIE_CVE-2026-89103", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T01:28:55.322Z", "date_only": false, "value": "2026-11-10T01:28:55.322086Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mzwc2a5xe72f", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "440c0e7c-3623-49f3-aa2f-faf59dbe9074", "content": "NVD published unauthenticated SAP flaws, including CVE-2026-89126 and CVE-2026-89103.\nSAP SE assigned the vectors.\nNVD has not published base scores, and the entries do not list a fix.\n\nthecircuitry.to/article/nvd-publishes-unauthenticated-sap-flaws-with-no-base-scores-yet-mwa0cs9l", "url": "https://bsky.app/profile/thecircuitry.to/post/3mzwc2a5xe72f"}, {"timestamp": "2026-11-10T01:30:02.961Z", "date_only": false, "value": "2026-11-10T01:30:02.961616Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzwc4batjz2f", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "b7f03587-4301-46bb-b7a9-2367c48c9449", "content": "CVE-2026-89103 - sap gateway\nSAP Gateway\u2019s default settings mistakenly treat anyone on the network as a trusted internal application server. This can let an outsider who reaches the gateway perform actions\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sapgateway #sapse #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzwc4batjz2f"}, {"timestamp": "2026-11-10T01:32:19.768Z", "date_only": false, "value": "2026-11-10T01:32:19.768189Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzwca7dphbs4", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "100b6578-15b4-41cd-a6ce-eac0a8bf4b02", "content": "CVE Radar | CVE-2026-89103 | CVSS 10.0\n\nCritical SAP Gateway Access Control Weakness\n\nCVE-2026-89103 affects SAP Gateway, where the default Access Control List is activated with high privileges.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1406", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mzwca7dphbs4"}, {"timestamp": "2026-11-10T01:32:21.035Z", "date_only": false, "value": "2026-11-10T01:32:21.035292Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzwcacg2ad2n", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "04be6286-da73-4eca-91ba-39f36a137756", "content": "\ud83d\udd34 CVE-2026-89103 - Critical (10)\n\nSAP Gateway activates the default Access Control List with high privileges allowing categorizatio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89103/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzwcacg2ad2n"}, {"timestamp": "2026-11-10T02:09:08.082Z", "date_only": false, "value": "2026-11-10T02:09:08.082212Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzwec42wdy26", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "bf7d15e9-54aa-4ae8-b354-50f3475883ba", "content": "\ud83d\udea8 CVE-2026-89103 \u2014 CVSS 10 CRITICAL\n\nSAP Gateway activates the default Access Control List with high privileges allowing categorization of exter...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89103\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzwec42wdy26"}, {"timestamp": "2026-11-10T03:30:34Z", "date_only": false, "value": "2026-11-10T03:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P6VW-54FJ-MJM4", "record": "GHSA-P6VW-54FJ-MJM4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T03:30:34Z", "date_only": false, "value": "2026-11-10T03:30:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P6VW-54FJ-MJM4", "record": "GHSA-P6VW-54FJ-MJM4", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T04:30:36.482Z", "date_only": false, "value": "2026-11-10T04:30:36.482629Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117590264092529197", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "5c3437a8-4f15-4827-8151-f7b77d157752", "content": "SAP Gateway's CRITICAL flaw (CVE-2026-89103, CVSS 10) enables unauthenticated attackers to gain high privileges by exploiting default ACLs \ud83d\udee1\ufe0f. No fix yet \u2014 restrict network access & monitor closely. Full details: https://radar.offseq.com/threat/sap-gateway-activates-the-default-access-control-list-with-high-privileges-allowing-categorization-of-1646224a14631f16#OffSeq #SAP #vuln #infosec", "url": "https://infosec.exchange/users/offseq/statuses/117590264092529197"}, {"timestamp": "2026-11-10T04:30:38.487Z", "date_only": false, "value": "2026-11-10T04:30:38.487073Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mzwm763drs2o", "record": "CVE-2026-89103", "field": "creation_timestamp", "uuid": "4bed7e0e-e37d-4b01-8760-83df6ff76b77", "content": "SAP Gateway vulnerability (CVE-2026-89103, CVSS 10) allows external attackers high privileges due to default ACL. No patch yet \u2014 limit network access & monitor activity. More info: https://radar.offseq.com/threat/sap-gateway-activates-the-default-access-control-list-with-high-privileges-allowing-...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mzwm763drs2o"}], "metrics": {"as_of": "2026-11-10T06:51:14.026Z", "anchors": {"origin": {"timestamp": "2026-11-10T00:18:43.492Z", "date_only": false, "value": "2026-11-10T00:18:43.492Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-89103", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T00:18:43.492Z", "date_only": false, "value": "2026-11-10T00:18:43.492Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-89103", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 23550.53435, "hours": 6.541815097222223, "days": 0.27257562905092597, "min_seconds": 23550.53435, "max_seconds": 23550.53435, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T00:18:43.492Z", "date_only": false, "value": "2026-11-10T00:18:43.492Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-89103", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T06:51:14.026Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}