Server-Side Request Forgery Vulnerability in SAP NetWeaver AS Java Web Services
CVE-2026-89129

5.8MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver As Java (web Services)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-89129?

A Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java allows unauthenticated attackers to manipulate SOAP requests. By doing so, they can cause the server to return a SOAP fault to a URL that the attacker controls. This exploitation may lead to the unintentional exposure of sensitive information regarding interconnected systems, thus posing a risk to confidentiality. However, the integrity and availability of the system remain unaffected. For further information, refer to SAP's security patches and notes.

Affected Version(s)

SAP NetWeaver AS Java (Web Services) ENGINEAPI 7.50

SAP NetWeaver AS Java (Web Services) J2EE-FRMW 7.50

References

https://me.sap.com/notes/3835738
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.