CVE-2026-89114: Missing Authentication check in SAP NetWeaver AS Java EDM Application
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker who can send requests to the affected SAP NetWeaver AS Java EDM Application web service interface could exploit it. No prior privileges or user interaction are required.
What is the likely impact of successful exploitation?
A successful attacker could retrieve sensitive business information. The provided data indicates confidentiality impact only; integrity and availability are not affected.
How can I determine whether my environment is affected?
Identify whether you run SAP NetWeaver AS Java EDM Application and review the relevant SAP security guidance in SAP Note 3810485. The vulnerability concerns certain web service requests that do not receive an authentication check.