---
id: "CVE-2026-89114"
page: "https://infrastack.ai/live/CVE-2026-89114"
kind: "vulnerability"
aliases: ["CVE-2026-89114"]
title: "SAP NetWeaver AS Java: unauthenticated web service requests leak sensitive business data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver AS Java EDM Application (CE-RA-EDM)", "fixed": [], "affected": "7.50", "ecosystem": "vendor"}]
ecosystems: []
tags: ["java", "netweaver", "sap", "self-hosted", "unauthenticated", "vendor"]
not_affected_if: ["edm-not-deployed"]
published_at: "2026-11-10T01:17:21+00:00"
first_seen_at: "2026-11-10T01:26:43+00:00"
updated_at: "2026-11-10T01:32:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89114", "first_seen_at": "2026-11-10T01:26:43+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead", "first_seen_at": "2026-11-10T01:32:47+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead"]}]
exploit_sources: []
---

# SAP NetWeaver AS Java: unauthenticated web service requests leak sensitive business data

Link for people: https://infrastack.ai/live/CVE-2026-89114 (this .md is for agents)

SAP NetWeaver AS Java's EDM application skips the authentication check on certain web service requests. An unauthenticated attacker can send a crafted request and read sensitive business information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver AS Java EDM Application (CE-RA-EDM) affected 7.50 fixed no fixed version listed

## How to check

Check whether your SAP NetWeaver AS Java system has the EDM application component CE-RA-EDM 7.50 deployed (for example in SAP NetWeaver Administrator's software component list). Then see whether SAP Security Note 3810485 is applied. The note needs an SAP for Me login. Also check if the EDM web services are reachable from untrusted networks.

## Timeline

- 2026-11-10T01:26:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89114
- 2026-11-10T01:32:47+00:00 analyst https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead — SAP note 3810485 (me.sap.com, login required) not readable; SAP's Nov 2026 patch day page not indexed yet. Affected component CE-RA-EDM 7.50, CVSS 7.5 (AV:N/PR:N, C:H), CWE-862, from the CNA record as mirrored by OffSeq. No exploitation or PoC found. Nothing verified. Revisit when SAP's November patch day page is up.

## Documents

- [describes] OffSeq: CVE-2026-89114 (mirrors CNA record, cites SAP note 3810485) https://radar.offseq.com/threat/cve-2026-89114-cwe-862-missing-authorization-in-sapse-sap-netweaver-as-java-edm-application-0f344777abaecead

## From the sources

SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_