CVE-2026-89128
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.