CVE-2026-89128

CVSS 5.3 (medium) · published 2026-11-10

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

Weakness: CWE-862

Source: NVD CVE-2026-89128

References

• https://me.sap.com/notes/3792447
• https://url.sap/sapsecuritypatchday

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.