PI Test Tool Broken Access Control: CVE-2026-89128 · CVSS 3.0 5.3 · SAP Note 3792447
Note 3792447 addresses the Process Integration Test Tool in SAP NetWeaver PI. Some of its SOAP operations were reachable over HTTP without access control. Consequently, an unauthenticated attacker could call them and read whatever information the service returned. SAP rates this issue at CVSS 5.3, Medium. In this post, we cover exposure, the fix and what to check.
PI Test Tool Broken Access Control: fix
The PI Test Tool Broken Access Control affects SAP_XIPIT 7.50. In this case, SAP removes the affected functions. So implement the support package patch, and follow SAP Note 952402 for deployment.
What to check
If test teams use PIT, first confirm which operations they rely on before patching. In addition, check HTTP logs on PI/PO systems for calls to PIT services from outside the integration team’s network. Such calls can reveal earlier attempts at this attack.
Why debugging utilities matter
Test tools often run in production systems, even though nobody needs them there. Moreover, they tend to have weaker access controls than the main application. Therefore, the PI Test Tool case is a reminder to review which test features remain active on PI/PO.
Network reach
PI/PO systems usually accept SOAP calls from partners and internal systems. As a result, the HTTP port can be reachable from many networks. Restricting PIT services at the Web Dispatcher or firewall further reduces this risk.
PI Test Tool Broken Access Control: advisory details
Component: BC-XI-PIT
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 13
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: SAP Security Note 3792447 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
