CVE-2026-89118

5.3Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-552

Impact

Unauthenticated remote attackers can read restricted resources and retrieve non-critical application data. They only need network access to the NetWeaver portal without any credentials.

Root cause

Files or directories are improperly exposed to unauthorized actors via unrestricted external access.

Affected systems

SAP NetWeaver Enterprise Portal (versions not listed — check the vendor advisory).

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Apply SAP Security Note 3789825 from the SAP Support Portal. If patching must wait, restrict external network access to the Enterprise Portal endpoints via your reverse proxy or firewall.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-89118