SAP NETWEAVER AS JAVA EDM APPLICATION (CE-RA-EDM) · CVE-2026-89114 · Vendor
NO FIX YET
SAP NetWeaver AS Java's EDM application skips the authentication check on certain web service requests. An unauthenticated attacker can send a crafted request and read sensitive business information.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP NetWeaver AS Java systems running the EDM application (CE-RA-EDM 7.50). An unauthenticated attacker with network access can send crafted web service requests and read sensitive business data. Systems where the EDM web services are not exposed to untrusted networks have a lower risk. Teams without NetWeaver AS Java or without this component can skip it.
Not affected if edm-not-deployed
Who cares java, netweaver, sap, self-hosted, unauthenticated
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.