CVE-2026-89129: Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services)
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an unauthenticated attacker could craft a SOAP request that causes the server to return a SOAP fault to a URL under the attacker�s control. Successful exploitation could allow the attacker to disclose information about connected systems, impacting confidentiality, while integrity and availability remain unaffected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely by crafting a SOAP request. No prior account or user interaction is required.
What could an attacker gain from successful exploitation?
The attacker may cause the affected server to return a SOAP fault to an attacker-controlled URL, potentially disclosing information about connected systems. The reported impact is limited to confidentiality; integrity and availability are not affected.
What service area should be prioritized for assessment?
Prioritize SAP NetWeaver AS Java Web Services endpoints that accept SOAP requests, especially where the system has connectivity to other internal or connected systems.