Description
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
Published: 2026-10-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to retrieve restricted, non‑critical application information, resulting in a low confidentiality impact with no effect on integrity or availability. The flaw is a classic example of insecure direct object reference or improper access control, identified as CWE‑552.

Affected Systems

Affected systems include SAP SE’s SAP NetWeaver Enterprise Portal. No specific product version details are provided in the data, so all current releases may potentially be impacted until a patch is applied.

Risk and Exploitability

With a CVSS score of 5.3, the severity is classified as low. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a lower likelihood of widespread exploitation. The inferred attack vector is remote, unauthenticated access over the network, where the attacker can request pages that expose sensitive information without authentication.

Generated by OpenCVE AI on October 13, 2026 at 02:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the SAP security fix described in SAP Note 3789825.
  • Reconfigure the portal to deny unauthenticated users access to restricted resources.
  • Continuously monitor portal logs for suspicious access attempts and verify that the policy changes remain effective.

Generated by OpenCVE AI on October 13, 2026 at 02:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap netweaver Enterprise Portal
Vendors & Products Sap
Sap netweaver Enterprise Portal

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
Title Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal
Weaknesses CWE-552
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Sap Netweaver Enterprise Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-13T13:28:29.850Z

Reserved: 2026-09-10T22:25:18.638Z

Link: CVE-2026-89118

cve-icon Vulnrichment

Updated: 2026-10-13T13:19:49.275Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T01:16:48.680

Modified: 2026-10-15T20:38:04.303

Link: CVE-2026-89118

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:15:15Z

Weaknesses
  • CWE-552

    Files or Directories Accessible to External Parties