Log in Start free

Vulnerability · Published Jul 28, 2026 · Assigned by sap

CVE-2026-58246Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Medium 4.3

In plain English

A medium-severity security flaw in SAP NetWeaver Application Server for ABAP from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP NetWeaver Application Server for ABAP SAP_BASIS 740SAP_BASIS 750SAP_BASIS 751SAP_BASIS 752SAP_BASIS 753SAP_BASIS 754SAP_BASIS 755SAP_BASIS 756

Weakness: CWE-497 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

References