{"id":"CVE-2026-89128","kind":"vulnerability","aliases":["CVE-2026-89128"],"related":[],"title":"SAP NetWeaver AS Java: unauthenticated SOAP calls can leak some service data","description":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.","summary":"SAP NetWeaver AS Java lacks proper access control on certain SOAP operations exposed over HTTP. An unauthenticated attacker can invoke them and read information the affected service makes available.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver AS Java","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","netweaver","sap","soap","vendor"],"not_affected_if":["no-netweaver-as-java","soap-services-not-exposed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:44+00:00","triaged_at":"2026-11-10T01:28:59+00:00","updated_at":"2026-11-10T01:28:59+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:28:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP NetWeaver AS Java: unauthenticated SOAP calls can leak some service data","impact":"low","summary":"SAP NetWeaver AS Java lacks proper access control on certain SOAP operations exposed over HTTP. An unauthenticated attacker can invoke them and read information the affected service makes available.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","java","soap"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads information from the affected SOAP service","analyst_note":"Check SAP's security notes for CVE-2026-89128 to identify affected releages, SOAP services, and the patch.","how_to_check":"unknown","plain_action":"","product_name":"SAP NetWeaver AS Java","needs_analyst":true,"not_affected_if":["no-netweaver-as-java","soap-services-not-exposed"],"who_is_affected":"Organizations running SAP NetWeaver AS Java with the affected SOAP services reachable over HTTP are exposed. The sources do not name the affected releases or which SOAP services are involved, so teams should check their SAP patch level and whether those services are exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4577,"output_tokens":497,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-89128':15A,18A 'access':34B,60C,80C,89C 'affect':53B,72C,92C 'allow':85C 'as':21A 'attack':45B,69C 'avail':56B,103C 'broken':59C 'call':7A 'certain':37B 'confidenti':100C 'control':35B,61C,81C 'could':70C,84C 'cve':13A,16A 'data':12A 'disclosur':86C 'due':57C 'exploit':83C 'expos':40B,75C 'http':42B,77C 'impact':98C 'inform':51B,88C 'integr':101C 'invok':47B,71C 'java':4A,22A,23B,31B,66C 'lack':32B 'leak':9A 'low':97C 'make':55B 'netweav':2A,24B,29B,64C 'netweaver':20A 'oper':39B,74C 'proper':33B,79C 'read':50B 'remain':104C 'result':94C 'sap':1A,19A,25B,28B,63C 'servic':11A,54B,93C 'soap':6A,26B,38B,73C 'success':82C 'unaffect':105C 'unauthent':5A,44B,68C 'vendor':27B 'without':78C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver AS Java with the affected SOAP services reachable over HTTP are exposed. The sources do not name the affected releases or which SOAP services are involved, so teams should check their SAP patch level and whether those services are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverasjava","sapnetweaverasjava"],"ptokens":["as","java","netweaver","sap"],"labels":["java","medium","netweaver","sap","soap","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-89128':15A,18A 'as':21A 'call':7A 'cve':13A,16A 'data':12A 'java':4A,22A 'leak':9A 'netweav':2A 'netweaver':20A 'sap':1A,19A 'servic':11A 'soap':6A 'unauthent':5A","search_b":"'access':34B 'affect':53B 'attack':45B 'avail':56B 'certain':37B 'control':35B 'expos':40B 'http':42B 'inform':51B 'invok':47B 'java':23B,31B 'lack':32B 'make':55B 'netweav':24B,29B 'oper':39B 'proper':33B 'read':50B 'sap':25B,28B 'servic':54B 'soap':26B,38B 'unauthent':44B 'vendor':27B","search_c":"'access':60C,80C,89C 'affect':72C,92C 'allow':85C 'attack':69C 'avail':103C 'broken':59C 'confidenti':100C 'control':61C,81C 'could':70C,84C 'disclosur':86C 'due':57C 'exploit':83C 'expos':75C 'http':77C 'impact':98C 'inform':88C 'integr':101C 'invok':71C 'java':66C 'low':97C 'netweav':64C 'oper':74C 'proper':79C 'remain':104C 'result':94C 'sap':63C 'servic':93C 'soap':73C 'success':82C 'unaffect':105C 'unauthent':68C 'without':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89128","severity":null,"published_at":"2026-11-10T01:17:22+00:00","modified_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:44+00:00","fetched_at":"2026-11-10T01:26:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}