[Single source] SAP NetWeaver Portal CSRF triggers actions through malicious links

Xbow reports that SAP Note 3801587 covers CVE-2026-89131, a cross-site request forgery issue in SAP NetWeaver Enterprise Portal rated Medium at CVSS 4.3. According to that account, an unauthenticated attacker can craft a link that causes server-side actions when a logged-in user clicks it.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list

The reported chain begins with an attacker preparing a malicious link. It then depends on an authenticated Enterprise Portal user opening that link, after which the application allegedly performs server-side actions through the user's active session.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

The issue matters because it could let an outsider bridge into actions available through a logged-in user's session without first authenticating. The need for user interaction and an existing session appears to constrain the attack, which is consistent with the reported Medium severity, although the supplied evidence does not describe the possible actions or impact.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

Administrators should review SAP Note 3801587 for applicability and official measures, while treating unexpected links aimed at Enterprise Portal users cautiously. The evidence supplied here does not specify affected versions, configuration requirements, a patch, or a workaround.[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

The available items identify the note number, CVE, product, reported attack pattern, Medium rating, and CVSS score. They do not establish affected releases, prerequisites beyond a logged-in user clicking a link, the exact server-side actions, exploitation in the wild, or remediation details.[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

Xbow characterizes CVE-2026-89131 as CSRF in NetWeaver Enterprise Portal and says an unauthenticated attacker can craft a link that triggers server-side actions when clicked by a logged-in user.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

The supplied SAP Note entry and Xbow post carry the same publication timestamp. This evidence therefore does not establish which appeared first or show any later revision, remediation update, or change in severity.[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

1 independent groups, 1 updates, and 1 engagements.

CSRF, or cross-site request forgery, abuses a user's authenticated browser session to submit an action the user did not intend. Here, Xbow alleges that the trigger can be embedded in a crafted link and that clicking it while logged in causes server-side actions, but the request format, endpoint, and privileges involved are not documented in the supplied evidence.[1]Xbowx.com · Xbow · xOpen original sourceSee in source list

The evidence includes a direct URL for SAP Note 3801587, but no title or body from that note. The substantive vulnerability details come from Xbow's post, so they should be treated as a secondary account until the note's contents or another authoritative advisory are available.[2]me.sap.comme.sap.com · rssOpen original sourceSee in source list[1]Xbowx.com · Xbow · xOpen original sourceSee in source list