CVE-2026-89118
published 2026-10-13CVE-2026-89118: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.21%
11.2th percentile
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_netweaver_enterprise_portal | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but t
ghsa_unreviewed·2026-10-13
CVE-2026-89118 [MEDIUM] CWE-552 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but t
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
VulDB
SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50 privileges management
vuldb·2026-10-13·CVSS 5.3
CVE-2026-89118 [MEDIUM] SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50 privileges management
A vulnerability identified as problematic has been detected in SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50. Impacted is an unknown function. This manipulation causes improper privilege management.
This vulnerability appears as CVE-2026-89118. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-13
Published