Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-89114

Missing authentication in SAP NetWeaver AS Java EDM web services

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-89114 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver AS Java EDM Application does not check authentication on certain web service requests. An unauthenticated remote attacker can send a crafted request and retrieve sensitive business information. Impact is limited to confidentiality; integrity and availability are unaffected. Systems running the EDM application are affected; SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-89114. No workaround is stated.

ProductAffected
SAP NetWeaver AS Java EDM Application—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.

Weakness
CWE-862
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories