medium · CVSS v3 5.8

CVE-2026-89129

SAP NetWeaver AS Java Web Services is vulnerable to an unauthenticated Server‑Side Request Forgery (SSRF) that allows an attacker to trigger

Overview

SAP NetWeaver AS Java Web Services is vulnerable to an unauthenticated Server‑Side Request Forgery (SSRF) that allows an attacker to trigger a SOAP fault to a URL under their control. This flaw can leak information about internal systems, compromising confidentiality. The vulnerability does not affect integrity or availability.

Description

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.

Impact

Unauthenticated attackers can obtain sensitive data about the network and connected services, potentially revealing IP addresses, hostnames, or service details. This information can be used for further reconnaissance or targeted attacks. The confidentiality of internal infrastructure is at risk, while integrity and availability remain intact.

Remediation

Apply the latest SAP security patch for NetWeaver AS Java (see SAP Note 3090000). Disable or restrict the SOAP endpoint that accepts external URLs. Configure outbound firewall rules to block internal requests to unknown destinations. Enable SAP NetWeaver AS Java security hardening guidelines and monitor SOAP fault logs for anomalous activity.

Risk context

The CVSS v3 score of 5.8 indicates medium risk; no EPSS data is available. Defenders should treat this as a moderate priority and apply patches promptly to mitigate potential data disclosure.

Affected products

  • SAP NetWeaver AS Java
  • SAP NetWeaver AS Java Web Services

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.8
CVSS v4
—
EPSS
—

SSRF SAP NetWeaver Web Services confidentiality medium patch

← All CVEs

Related CVEs

medium

CVE-2026-109796

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

View analysis

medium

CVE-2026-109801

SAP NetWeaver Application Server Java (NWDI Cockpit) has an authorization bypass that allows low‑privilege users to retrieve sensitive data from other users. This flaw can expose confidential information without affecting integrity or availability. Defenders should ensure the latest patch is applied and review access controls.

View analysis

medium

CVE-2026-109802

SAP NetWeaver Application Server for ABAP contains an input validation flaw that allows authenticated users to send crafted requests, triggering internal errors that crash work processes and cause a denial of service. The flaw does not affect confidentiality or integrity, but it can render the system unavailable. It is a medium‑severity vulnerability with a CVSS score of 6.5.

View analysis

medium

CVE-2026-109805

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.

View analysis