Medium 5.3

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke...

CVE-2026-89128 First seen on SecPulse Nov 10, 09:35

Original description The description as published by the source.

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 09:35
GHSA: GHSA-qpx6-8hqw-xr2c
CWE: CWE-862

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Java

CWE

CWE-862

All

Sap Se Sap Netweaver As Java Process Integration Test Tool

Detection sources

NIST National Vulnerability Database07:11
GitHub Security Advisories (Global)Nov 10, 12:30
CVE.org (CVE Program・cvelistV5)05:39