CVE-2026-89118 · CVSS 3.0 5.3 · SAP Note 3789825
Some NetWeaver Enterprise Portal resources were reachable anonymously when they should have been restricted. SAP Note 3789825 blocks access to those endpoints. The information described by SAP is non-critical application information, with a low confidentiality impact.
Anonymous access, without a victim click
CVE-2026-89118 has CVSS 5.3 and Medium priority. The vector requires neither privileges nor user interaction. SAP reports no integrity or availability impact. This makes the exposure different from October’s portal XSS and redirect issues, which depend on another user following crafted content.
EP-RUNTIME 7.50 patch branches
SAP lists SP30/PL14, SP31/PL14, SP32/PL13, SP33/PL8, SP34/PL8, SP35/PL6 and SP36/PL2. SP37 and SP38 are listed at PL0. Select the correction for the installed branch and verify the deployed EP-RUNTIME version across the portal landscape. These entries also match the correction levels in the separate open-redirect Note 3790401.
Check access from outside an authenticated session
Normal tests performed while signed in can overlook anonymous disclosure. After patching, verify the intended restrictions with an approved unauthenticated test session, then confirm ordinary authenticated portal workflows still function. A review of Internet exposure helps set deployment priority, but the advisory does not establish that the disclosed information was used in a wider attack.
Advisory details
Component: EP-PIN-CS
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: SAP Security Note 3789825 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
