AS Java Web Services SSRF: CVE-2026-89129 · CVSS 3.0 5.8 · SAP Note 3835738
Note 3835738 fixes the WS-Addressing handler in SAP NetWeaver AS Java. The handler accepted callback addresses from the wsa:ReplyTo and wsa:FaultTo SOAP headers. Then it made outbound HTTP requests to them without validation, including to loopback, link-local and private ranges. Moreover, no authentication was necessary. SAP rates the AS Java Web Services SSRF at CVSS 5.8, Medium. In this post, we cover exposure, the fix and what to check.
AS Java Web Services SSRF: fix and new property
The fix covers ENGINEAPI and J2EE-FRMW 7.50. After patching, set wsa.callback.whitelist in the webservices service properties to the callback hosts you actually use. If you use none, leave it empty. The patched handler blocks callbacks to private or loopback addresses unless you allow them. Therefore, test asynchronous web services before going live.
Workaround
Until you patch, block untrusted clients from SOAP endpoints with WS-Addressing at the Web Dispatcher or firewall. Alternatively, disable WS-Addressing on endpoints that do not need asynchronous callbacks. Both options reduce this exposure quickly.
Why SSRF matters
SSRF turns the Java server into a proxy for the attacker. For example, the server can reach internal admin interfaces or cloud metadata services. As a result, the AS Java Web Services SSRF can expose systems that the attacker cannot reach directly.
What to check
First, list SOAP endpoints with WS-Addressing enabled. Next, decide which really need callbacks and add only those hosts to the allowlist. Finally, review HTTP logs for SOAP requests with unusual ReplyTo or FaultTo values, since they can reveal attempts to use the AS Java Web Services SSRF.
AS Java Web Services SSRF: advisory details
Component: BC-JAS-SEC-WSS
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: SAP Security Note 3835738 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
