SAP NETWEAVER AS JAVA · CVE-2026-89128 · Vendor
NO FIX YET
SAP NetWeaver AS Java lacks proper access control on certain SOAP operations exposed over HTTP. An unauthenticated attacker can invoke them and read information the affected service makes available.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver AS Java with the affected SOAP services reachable over HTTP are exposed. The sources do not name the affected releases or which SOAP services are involved, so teams should check their SAP patch level and whether those services are exposed.
Not affected if no-netweaver-as-java, soap-services-not-exposed
Who cares java, netweaver, sap, soap
Unknown from the sources.
No fix yet, per the sources.
Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.