{"id":"CVE-2026-89129","kind":"vulnerability","aliases":["CVE-2026-89129"],"related":[],"title":"SAP NetWeaver AS Java: SOAP request leaks data about connected systems","description":"Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.","summary":"An unauthenticated attacker can send a crafted SOAP request that makes the NetWeaver AS Java server contact a URL the attacker controls. The attacker can use this to learn information about the systems connected to the server.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver AS Java","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","netweaver","sap","vendor","web-services"],"not_affected_if":["no-netweaver-as-java"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:44+00:00","triaged_at":"2026-11-10T01:28:57+00:00","updated_at":"2026-11-10T01:28:57+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T01:28:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP NetWeaver AS Java: SOAP request leaks data about connected systems","impact":"low","summary":"An unauthenticated attacker can send a crafted SOAP request that makes the NetWeaver AS Java server contact a URL the attacker controls. The attacker can use this to learn information about the systems connected to the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","java","web-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker learns details about internal connected systems","analyst_note":"Find SAP's security note for CVE-2026-89129 to confirm affected releases, fixed patch levels and any setting to change.","how_to_check":"- unknown","plain_action":"","product_name":"SAP NetWeaver AS Java","needs_analyst":true,"not_affected_if":["no-netweaver-as-java"],"who_is_affected":"Organizations running SAP NetWeaver AS Java with the Web Services component are the ones exposed, since the SSRF is in the SOAP handling. The sources do not state which versions or configurations are affected, so the team should check their own deployment. Teams not running NetWeaver AS Java can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4604,"output_tokens":497,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-89129':14A,17A 'allow':111C 'as':20A 'attack':31B,49B,52B,85C,105C,113C 'avail':125C 'caus':92C 'confidenti':121C 'connect':10A,62B,118C 'contact':45B 'control':50B,107C 'could':86C,110C 'craft':35B,87C 'cve':12A,15A 'data':8A 'disclos':115C 'due':66C 'exploit':109C 'fault':99C 'forgeri':73C 'impact':120C 'inform':58B,116C 'integr':123C 'java':4A,21A,22B,43B,80C 'leak':7A 'learn':57B 'make':39B 'netweav':2A,23B,41B,78C 'netweaver':19A 'remain':126C 'request':6A,37B,72C,90C 'return':96C 'sap':1A,18A,24B,77C 'send':33B 'server':44B,65B,70C,94C 'server-sid':69C 'servic':28B,82C 'side':71C 'soap':5A,36B,89C,98C 'ssrf':74C 'success':108C 'system':11A,61B,119C 'unaffect':127C 'unauthent':30B,84C 'url':47B,102C 'use':54B 'vendor':25B 'vulner':75C 'web':27B,81C 'web-servic':26B","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver AS Java with the Web Services component are the ones exposed, since the SSRF is in the SOAP handling. The sources do not state which versions or configurations are affected, so the team should check their own deployment. Teams not running NetWeaver AS Java can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverasjava","sapnetweaverasjava"],"ptokens":["as","java","netweaver","sap"],"labels":["java","medium","netweaver","sap","vendor","webservices"],"campaign_type":null,"search_a":"'-2026':13A,16A '-89129':14A,17A 'as':20A 'connect':10A 'cve':12A,15A 'data':8A 'java':4A,21A 'leak':7A 'netweav':2A 'netweaver':19A 'request':6A 'sap':1A,18A 'soap':5A 'system':11A","search_b":"'attack':31B,49B,52B 'connect':62B 'contact':45B 'control':50B 'craft':35B 'inform':58B 'java':22B,43B 'learn':57B 'make':39B 'netweav':23B,41B 'request':37B 'sap':24B 'send':33B 'server':44B,65B 'servic':28B 'soap':36B 'system':61B 'unauthent':30B 'url':47B 'use':54B 'vendor':25B 'web':27B 'web-servic':26B","search_c":"'allow':111C 'attack':85C,105C,113C 'avail':125C 'caus':92C 'confidenti':121C 'connect':118C 'control':107C 'could':86C,110C 'craft':87C 'disclos':115C 'due':66C 'exploit':109C 'fault':99C 'forgeri':73C 'impact':120C 'inform':116C 'integr':123C 'java':80C 'netweav':78C 'remain':126C 'request':72C,90C 'return':96C 'sap':77C 'server':70C,94C 'server-sid':69C 'servic':82C 'side':71C 'soap':89C,98C 'ssrf':74C 'success':108C 'system':119C 'unaffect':127C 'unauthent':84C 'url':102C 'vulner':75C 'web':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89129","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89129","severity":null,"published_at":"2026-11-10T01:17:22+00:00","modified_at":"2026-11-10T01:17:22+00:00","first_seen_at":"2026-11-10T01:26:44+00:00","fetched_at":"2026-11-10T01:26:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}