AS Java EDM Missing Authentication: CVE-2026-89114 · CVSS 3.0 7.5 · SAP Note 3810485
Note 3810485 deals with the EDM application (xapps~ra.edm.prjmgmt.jee.app) on SAP NetWeaver AS Java. It served certain web service requests without authenticating the caller. As a result, an unauthenticated attacker could retrieve sensitive business information. SAP rates the AS Java EDM Missing Authentication at CVSS 7.5, High. Interestingly, SAP’s fix removes the application entirely. In this post, we cover exposure, the fix and what to check.
AS Java EDM Missing Authentication: fix
The AS Java EDM Missing Authentication sits in component CE-RA-EDM 7.50. Implementing the support package patch removes EDM from the system as part of SUM updates. Before deploying, however, check SAP Note 1974464 for SCA dependencies.
Workaround
If you cannot patch now, disable the application with a filter. In NetWeaver Administrator, open Java System Properties and then Filters. There, add a local filter with action disable, vendor sap.com, component application and name mask xapps~ra.edm.prjmgmt.jee.app. Then restart the system. Alternatively, the Config Tool offers the same option in expert mode. Either way, the filter blocks this issue until the patch.
What to check
Most customers never used EDM. So first confirm that with the business. Next, apply the filter. Finally, look in HTTP access logs for requests to the EDM web service from unexpected sources, since those can show earlier attempts to use the AS Java EDM Missing Authentication.
A wider lesson
Unused applications on AS Java still listen for requests. Therefore, the AS Java EDM Missing Authentication is a good reason to review which applications run on each Java system. Disabling what nobody uses removes risk before the next note arrives.
AS Java EDM Missing Authentication: advisory details
Component: BC-DWB-JAV-J2E
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: SAP Security Note 3810485 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
