Broken Access Control in SAP NetWeaver AS Java Exposes SOAP Operations

CVE-2026-89128

What is CVE-2026-89128?

The vulnerability in SAP NetWeaver AS Java arises from improper access controls on specific SOAP operations available over HTTP. This flaw allows an unauthenticated attacker to invoke these operations without appropriate permissions, potentially leading to the disclosure of sensitive information accessible through the exposed service. While the impact on confidentiality is notable, the integrity and availability of the system remain intact. Organizations using affected versions of the product should prioritize applying relevant security patches and updates to mitigate risks associated with this vulnerability.

References