CVE-2026-89128— Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)

Quick assessment

Affected

SAP_SE SAP NetWeaver AS Java (Process Integration Test Tool)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

由于 SAP NetWeaver AS Java 中存在访问控制缺陷，未认证的攻击者可在缺乏适当访问控制的情况下，通过 HTTP 调用受影响的 SOAP 操作。成功利用该漏洞可能导致通过受影响服务可访问的信息被泄露，对机密性造成低级别影响；完整性和可用性不受影响。

CVSS 5.3 · Medium Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1048 · Exfiltration Over Alternative Protocol T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)

Source: CVE Program / CVE List V5

Vulnerability Description

Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SAP_SE	SAP NetWeaver AS Java (Process Integration Test Tool)	SAP_XIPIT 7.50	-

II. Public POCs for CVE-2026-89128

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-89128

请登录查看更多情报信息。

Other References for CVE-2026-89128 (1)

https://me.sap.com/notes/3792447

https://www.cve.org/CVERecord?id=CVE-2026-89128

Same Patch Batch · SAP_SE · 2026-11-10 · 40 CVEs total

CVE-2026-76964	10.0 CRITICAL	Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
CVE-2026-120017	10.0 CRITICAL	Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
CVE-2026-89126	10.0 CRITICAL	Memory Corruption vulnerability in SAP Web Dispatcher
CVE-2026-89103	10.0 CRITICAL	Broken Access Control in SAP Gateway
CVE-2026-109795	9.9 CRITICAL	Missing authorization check in S4CRM
CVE-2026-76965	9.9 CRITICAL	OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP P
CVE-2026-109803	9.9 CRITICAL	Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)
CVE-2026-89119	9.6 CRITICAL	Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi
CVE-2026-109798	9.1 CRITICAL	XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platf
CVE-2026-76966	8.9 HIGH	Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
CVE-2026-120008	8.2 HIGH	Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)
CVE-2026-109800	7.7 HIGH	Memory Corruption vulnerability in SAP Web Dispatcher
CVE-2026-120014	7.6 HIGH	Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi
CVE-2026-109794	7.5 HIGH	Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform an
CVE-2026-109793	7.5 HIGH	Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet C
CVE-2026-109804	7.5 HIGH	Information Disclosure in SAP NetWeaver (SAP Message Server)
CVE-2026-109806	7.5 HIGH	Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
CVE-2026-109807	7.5 HIGH	Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
CVE-2026-89114	7.5 HIGH	Missing Authentication check in SAP NetWeaver AS Java EDM Application
CVE-2026-76973	7.5 HIGH	Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platf

Showing top 20 of 40 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: SAP_SE

Same weakness: CWE-862