Authentication Bypass in SAP NetWeaver AS Java EDM Application
CVE-2026-89114

7.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver As Java Edm Application
Vendor
CVE Published:
10 November 2026

What is CVE-2026-89114?

The SAP NetWeaver AS Java EDM Application contains a significant vulnerability that allows for an authentication bypass on specific web service requests. This flaw enables an unauthenticated attacker to submit specially crafted requests, potentially leading to the exposure of sensitive business information. While the integrity and availability of the system remain intact, the compromise of confidentiality poses serious risks for organizations relying on these services. It is crucial to implement the necessary patches and security measures to mitigate this vulnerability.

Affected Version(s)

SAP NetWeaver AS Java EDM Application CE-RA-EDM 7.50

References

https://me.sap.com/notes/3810485
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.