SAP NetWeaver Portal CVE-2026-89118

Exploitation requires network reachability to an exposed SAP NetWeaver Enterprise Portal instance; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against affected configurations. The description does not name a specific feature toggle, so the condition is simply that the portal's resource-handling endpoint is network-accessible. The limiting factor is impact scope rather than access: only restricted, non-critical application information is exposed (C:L, I:N, A:N), so a successful attack yields reconnaissance-grade data rather than credentials, code execution, or full file disclosure. Exposure is further limited where the portal is not internet-facing or sits behind a reverse proxy/WAF restricting path traversal patterns.

This is a moderate-severity information disclosure flaw (CVSS 5.3) in SAP NetWeaver Enterprise Portal, mapped to CWE-552 (Files or Directories Accessible to External Parties) and tagged as Path Traversal. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, which raises exploitability, but the impact is deliberately bounded: Confidentiality is Low (C:L) with no Integrity or Availability impact, and the vendor explicitly states only 'non-critical application information' is exposed. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; there is no public exploit identified at time of analysis. The signals are internally consistent - easy to reach but low payoff - so this is best treated as a routine patch-cycle item rather than an emergency, though in SAP environments it is valuable as a reconnaissance primitive that can feed higher-impact follow-on attacks. No key signals conflict; the main gap is the absence of EPSS/KEV/POC telemetry to confirm real-world interest.

An unauthenticated attacker who can reach the Enterprise Portal over the network sends a crafted request (likely a path-traversal or direct resource reference) to read restricted resources and harvest non-critical application information such as configuration details or file contents. This leaked data has low direct impact but can be used to fingerprint the deployment and plan further targeted attacks. No public proof-of-concept was provided in the input.