CVE-2026-89118: SAP NetWeaver Portal Information Disclosure

CVE-2026-89118 Overview

CVE-2026-89118 is an information disclosure vulnerability in SAP NetWeaver Enterprise Portal. An unauthenticated remote attacker can access restricted resources and retrieve non-critical application information over the network. The flaw is tracked under CWE-552: Files or Directories Accessible to External Parties.

The vulnerability affects confidentiality only. Integrity and availability of the portal remain unaffected. SAP addressed the issue as part of its Security Patch Day release and published remediation guidance in SAP Note #3789825.

Critical Impact
Unauthenticated attackers can enumerate restricted resources on exposed SAP NetWeaver Enterprise Portal instances, exposing non-critical application data that may aid reconnaissance against downstream SAP systems.

Affected Products

SAP NetWeaver Enterprise Portal
Deployments exposing the Enterprise Portal to untrusted networks
Refer to SAP Note #3789825 for the authoritative component and version list

Discovery Timeline

2026-10-13 - CVE-2026-89118 published to the National Vulnerability Database
2026-10-13 - SAP publishes SAP Note #3789825 on SAP Security Patch Day
2026-10-15 - Last updated in the NVD database

Technical Details for CVE-2026-89118

Vulnerability Analysis

The vulnerability resides in SAP NetWeaver Enterprise Portal, a web-based platform that aggregates SAP and non-SAP content for enterprise users. The portal exposes resources that should be restricted to authenticated sessions. Due to improper access control enforcement, an unauthenticated remote attacker can request these resources directly and receive their contents.

The exposed data is classified by SAP as non-critical application information. Even so, disclosed metadata, configuration fragments, or resource paths may support reconnaissance against the broader SAP landscape. Attackers often chain low-severity disclosure flaws with other weaknesses during multi-stage intrusions targeting ERP environments.

Root Cause

The weakness maps to CWE-552: Files or Directories Accessible to External Parties. The portal fails to apply authorization checks consistently on specific resource endpoints. As a result, requests that should return 401 Unauthorized or 403 Forbidden instead return the requested content. SAP has not published detailed technical internals, directing customers to the fix in SAP Note #3789825.

Attack Vector

Exploitation requires only network access to the portal. No authentication, user interaction, or elevated privileges are needed. An attacker sends crafted HTTP requests to the affected endpoints and parses the responses for exposed information. No public proof-of-concept or active exploitation has been reported at the time of writing.

// No verified exploit code is available for CVE-2026-89118.
// Refer to SAP Note #3789825 for vendor technical details.

Detection Methods for CVE-2026-89118

Indicators of Compromise

Unauthenticated HTTP requests from external sources targeting SAP NetWeaver Enterprise Portal resource paths that normally require authentication
200 OK responses to anonymous requests on endpoints that should return 401 or 403
Repeated enumeration patterns against portal URIs from a single source IP or ASN

Detection Strategies

Review web server and reverse proxy logs for anonymous access to Enterprise Portal paths and compare against expected authentication behavior
Deploy web application firewall rules that alert on unauthenticated access to internal portal resources
Correlate SAP Gateway and ICM traces with perimeter logs to identify reconnaissance activity preceding deeper exploitation attempts

Monitoring Recommendations

Forward SAP NetWeaver application and HTTP logs to a centralized SIEM for retention and correlation
Baseline normal unauthenticated traffic to the portal and alert on deviations in volume or URI diversity
Monitor for scanner user-agents and known reconnaissance tooling targeting SAP portal endpoints

How to Mitigate CVE-2026-89118

Immediate Actions Required

Apply the patch referenced in SAP Note #3789825 during the next change window
Inventory all SAP NetWeaver Enterprise Portal instances, including non-production systems reachable from untrusted networks
Restrict internet exposure of the portal to only the hostnames and paths required for business use

Patch Information

SAP released the fix on Security Patch Day. Customers must review SAP Note #3789825 for the exact support packages, kernel patches, or manual corrections applicable to their deployment. The SAP Security Patch Day Announcement lists the full set of notes released concurrently and should be reviewed for related fixes.

Workarounds

Place the Enterprise Portal behind an authenticating reverse proxy or VPN until the SAP note is applied
Use network access control lists to limit inbound connections to trusted administrative and user ranges
Disable or block the specific vulnerable endpoints identified in SAP Note #3789825 when patching is not immediately feasible

bash

# Example: restrict access to the SAP NetWeaver Enterprise Portal at the
# reverse proxy layer until SAP Note #3789825 is applied.
# Replace the CIDR ranges with your trusted administrative networks.
location /irj/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny  all;
    proxy_pass https://sap-portal.internal;
}