The vulnerability exists because SAP NetWeaver Visual Composer does not perform sufficient authorization checks in specific portal functionality. An attacker who only has low-level privileges can invoke internal operations on a preconfigured remote system. Depending on how the remote connection is configured, this exploitation could result in a full compromise of that remote system, affecting confidentiality, integrity, and availability.

The affected product is SAP NetWeaver Visual Composer from SAP. No specific version range is provided in the CNA data, so all installations of SAP NetWeaver Visual Composer may be impacted unless a patch is applied.

The CVSS score of 9.9 classifies the vulnerability as critical, and the EPSS score is unavailable, indicating that its exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the portal functionality that can be accessed by users with minimal privileges; an attacker would send crafted requests to invoke protected internal operations without proper authorization.