Log in Start free

Vulnerability · Published Sep 8, 2026 · Assigned by sap

CVE-2026-58240Missing Authentication check in SAP NetWeaver (Message Server)

Critical 9.8

In plain English

A critical-severity security flaw in SAP NetWeaver (Message Server) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP NetWeaver (Message Server) KERNEL 9.169.189.199.20

Weakness: CWE-308 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References