SAP NETWEAVER AS JAVA · CVE-2026-89129 · Vendor
NO FIX YET
An unauthenticated attacker can send a crafted SOAP request that makes the NetWeaver AS Java server contact a URL the attacker controls. The attacker can use this to learn information about the systems connected to the server.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver AS Java with the Web Services component are the ones exposed, since the SSRF is in the SOAP handling. The sources do not state which versions or configurations are affected, so the team should check their own deployment. Teams not running NetWeaver AS Java can skip it.
Not affected if no-netweaver-as-java
Who cares java, netweaver, sap, web-services
Unknown from the sources.
No fix yet, per the sources.
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.