medium · CVSS v3 5.3

CVE-2026-89128

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations…

Description

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-109796

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

View analysis

medium

CVE-2026-109801

SAP NetWeaver Application Server Java (NWDI Cockpit) has an authorization bypass that allows low‑privilege users to retrieve sensitive data from other users. This flaw can expose confidential information without affecting integrity or availability. Defenders should ensure the latest patch is applied and review access controls.

View analysis

medium

CVE-2026-109802

SAP NetWeaver Application Server for ABAP contains an input validation flaw that allows authenticated users to send crafted requests, triggering internal errors that crash work processes and cause a denial of service. The flaw does not affect confidentiality or integrity, but it can render the system unavailable. It is a medium‑severity vulnerability with a CVSS score of 6.5.

View analysis

medium

CVE-2026-109805

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.

View analysis