---
id: "CVE-2026-89128"
page: "https://infrastack.ai/live/CVE-2026-89128"
kind: "vulnerability"
aliases: ["CVE-2026-89128"]
title: "SAP NetWeaver AS Java: unauthenticated SOAP calls can leak some service data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver AS Java", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["java", "netweaver", "sap", "soap", "vendor"]
not_affected_if: ["no-netweaver-as-java", "soap-services-not-exposed"]
published_at: "2026-11-10T01:17:22+00:00"
first_seen_at: "2026-11-10T01:26:44+00:00"
updated_at: "2026-11-10T01:28:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89128", "first_seen_at": "2026-11-10T01:26:44+00:00"}]
exploit_sources: []
---

# SAP NetWeaver AS Java: unauthenticated SOAP calls can leak some service data

Link for people: https://infrastack.ai/live/CVE-2026-89128 (this .md is for agents)

SAP NetWeaver AS Java lacks proper access control on certain SOAP operations exposed over HTTP. An unauthenticated attacker can invoke them and read information the affected service makes available.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver AS Java affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T01:26:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89128

## From the sources

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_