CVE-2026-89114

SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.

• CWE-862

• https://me.sap.com/notes/3810485
• https://url.sap/sapsecuritypatchday

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89108SAP Manufacturing Integration and Intelligence does not suff…9.1
• CVE-2026-8911The WP AutoBuzz plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2026-89110SAP NetWeaver Visual Composer does not perform sufficient au…9.9
• CVE-2026-89111The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnera…10
• CVE-2026-89112The admin API endpoint used to retrieve CLA signature record…6.5
• CVE-2026-89113SAP Commerce Cloud does not sufficiently validate certain us…8.8
• CVE-2026-89115SAP Start Service and SAP Management Console store sensitive…4.4
• CVE-2026-89116The affected code used child_process.execSync with a shell s…5.9
• CVE-2026-89117SAP NetWeaver Enterprise Portal allows an unauthenticated at…6.1
• CVE-2026-89118SAP NetWeaver Enterprise Portal allows an unauthenticated at…5.3
• CVE-2026-89119SAP Web Dispatcher and SAP NetWeaver Application Server ABAP…9.6
• CVE-2026-8912The Contest Gallery plugin for WordPress is vulnerable to SQ…7.5