WhatBrokeToday
FAQ
Today's Trends
highInvestigatingJava

SAP NetWeaver AS Java EDM Application Unauthenticated Information Disclosure Vulnerability

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

An unauthenticated information disclosure vulnerability (CVE-2026-89114) exists in the SAP NetWeaver AS Java EDM Application due to a missing authentication check for specific web service requests. Attackers can exploit this to retrieve sensitive business information, impacting confidentiality with no effect on integrity or availability.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

The application fails to perform an authentication check for certain web service requests.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    SAP NetWeaver AS Java EDM Application: CVE-2026-89114 (High)(opens security advisory in a new tab)

    High severity. SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    SAP NetWeaver AS Java EDM Application: CVE-2026-89114 (High)

    Source