CVE-2026-89129
Last modified
CVE-2026-89129 is a medium-severity vulnerability rated 5.8/10 on the CVSS scale. Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver AS Java (Web Services) | ENGINEAPI 7.50; J2EE-FRMW 7.50 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-89129?
How severe is CVE-2026-89129?
How do I fix CVE-2026-89129?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89121SAP S/4HANA does not perform sufficient instance-level autho…4.7
- CVE-2026-89122SAP NetWeaver Enterprise Portal does not sufficiently valida…6.1
- CVE-2026-89124Display Product Catalog Based on Customs Declaration applica…4.3
- CVE-2026-89125Due to Insecure Storage of Sensitive Information in SAP Web …6
- CVE-2026-89126SAP Web Dispatcher does not sufficiently validate certain ne…10
- CVE-2026-89128Due to Broken Access Control in SAP NetWeaver AS Java, an un…5.3
- CVE-2026-8913A command Injection vulnerability exists in the WireGuard cl…8.5
- CVE-2026-89131SAP NetWeaver Enterprise Portal does not sufficiently protec…4.3
- CVE-2026-89133wolfSSL versions 5.9.2 and earlier contain a flaw in the X.5…5.3
- CVE-2026-89134A certificate with no dNSName SAN but another SAN type prese…9.1
- CVE-2026-89135A failed X509_verify_cert call permanently plants an unverif…6.5
- CVE-2026-89136When using RPK (Raw Public Key), the client side of a TLS 1.…8.3
Are you affected by CVE-2026-89129?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST