Vulnerability · Published Oct 13, 2026 · Assigned by sap
CVE-2026-58249Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
High 7.5
In plain English
A high-severity security flaw in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) | HDB 2.00KRNL64UC 7.53WEBDISP 7.537.547.777.939.16XS_ADVANCED_RUNTIME 1.00 |
Weakness: CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H