CVE-2026-89129 PUBLISHED

Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services)

Assigner: sap
Reserved: 10.09.2026 Published: 10.11.2026 Updated: 10.11.2026

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS Score: 5.8

Product Status

Vendor SAP_SE
Product SAP NetWeaver AS Java (Web Services)
Versions Default: unaffected
  • Version ENGINEAPI 7.50 is affected
  • Version J2EE-FRMW 7.50 is affected

References

Problem Types