{"id":"CVE-2026-89128","aliases":["EUVD-2026-120675","GHSA-qpx6-8hqw-xr2c"],"status":"published","title":"Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)","description":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00201,"percentile":0.10048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-10T00:35:03Z","modified":"2026-11-10T03:30:39Z","products":[{"vendor":"sap_se","product":"sap netweaver as java (process integration test tool)"}],"references":[{"url":"https://me.sap.com/notes/3792447"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89128"},{"url":"https://github.com/advisories/GHSA-qpx6-8hqw-xr2c"}],"sources":{"cve":[{"id":"CVE-2026-89128","title":"Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)","description":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.","status":"published","published":"2026-11-10T00:35:03.418Z","modified":"2026-11-10T20:39:19.467Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-10T01:35:56.410062Z"}],"euvd":[{"id":"EUVD-2026-120675","description":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.","status":"published","published":"2026-11-10T00:35:03Z","modified":"2026-11-10T20:39:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-10T05:19:59.129782Z"}],"ghsa":[{"id":"GHSA-qpx6-8hqw-xr2c","title":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke...","description":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.","status":"published","published":"2026-11-10T03:30:34Z","modified":"2026-11-10T03:30:39Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-10T03:51:51.547106Z"}],"nvd":[{"id":"CVE-2026-89128","description":"Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP operations exposed over HTTP without proper access control. Successful exploitation could allow disclosure of information accessible through the affected service, resulting in a low impact on confidentiality. Integrity and availability remain unaffected.","status":"published","published":"2026-11-10T01:17:22.573Z","modified":"2026-11-10T22:11:23.807Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-11T00:21:53.560779Z"}]}}