Medium 5.8

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services)...

CVE-2026-89129 First seen on SecPulse Nov 10, 09:35

Original description The description as published by the source.

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 09:35
GHSA: GHSA-pjpr-98jv-wmjq
CWE: CWE-918

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

Java

Attack Types

Server-Side Request Forgery

CWE

CWE-918

All

Sap Se Sap Netweaver As Java Web Services

Detection sources

NIST National Vulnerability Database07:11
GitHub Security Advisories (Global)Nov 10, 12:30
CVE.org (CVE Program・cvelistV5)05:37