CVE-2026-89128: Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)
Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SAP NetWeaver AS Java deployments using the Process Integration Test Tool are exposed if they have affected SOAP operations available over HTTP. The issue can be reached remotely over the network.
What does an attacker need to exploit it?
An attacker does not need authentication, prior privileges, or user interaction. They need to be able to invoke the affected HTTP-exposed SOAP operations.
What is the likely impact of successful exploitation?
Successful exploitation can disclose information accessible through the affected service. The provided assessment indicates no impact to integrity or availability.
What should be reviewed while remediation is pending?
Review whether Process Integration Test Tool SOAP operations are exposed over HTTP and reachable by untrusted network clients. Restricting access to those exposed operations can reduce unauthenticated attack exposure while remediation is addressed.