CVE-2026-58240

Published Sep 8, 2026

Last updated 2 months ago

CVSS critical 9.8
SAP
onapsis

Overview

Description
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Source
cna@sap.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-308

Social media

Hype score
Not currently trending

  1. Released @OWASP CBAS' pysap v0.2.1! EPP (Extended Passport) support, Message Server monitoring and packet handling, improved SAP Router fingerprinting, ++ Packets for both CVE-2026-58240 and CVE-2026-44756 now supported also! https://t.co/2fvnlJAqtv and on PyPi 😊

    @MartinGalloAr

    21 Sept 2026

    105 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 ALERTĂ - Vulnerabilități critice identificate la nivelul unor produse SAP 🔐 Printre vulnerabilitățile remediate se numără CVE-2026-44756, CVE-2026-58240, CVE-2026-76969 și CVE-2026-66768, toate clasificate drept vulnerabilități critice. 👉 https://t.co/Lq1pp

    @DNSC_RO

    11 Sept 2026

    156 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. News: SAP Patch Day: OVERPASS CVE-2026-44756 max-severity kernel EPP overflow lets unprivileged actors get admin on SAP via ICM. Onapsis: 10k+ internet-facing. Also S4GET CVE-2026-58240 unauth Message Server RCE. Patch Sep notes now. https://t.co/l1a1JEeOEJ

    @snakeyesV1

    8 Sept 2026

    97 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-44756 CVE-2026-75650 CVE-2026-86296 CVE-2026-18922 CVE-2026-58240 ..🧵👇

    @exploitgrid

    8 Sept 2026

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric. September patch day: CVE-2026-44756 and CVE-2026-58240. No exploitation reported. https://t.co/5vpeh6itnD

    @severitydaily

    8 Sept 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacke… https://t.co/46T6olyz9m

    @CVEnew

    8 Sept 2026

    1082 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2026-44772
  2. SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.•CVE-2026-89107
  3. SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.•CVE-2026-89108
  4. SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.•CVE-2026-89110
  5. The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. This vulnerability was originally fixed in 0.45.2. It was reintroduced in 0.53.0 when the HTTP client was refactored into a shared core module, and the tenant subdomain validation was not carried over to the new location. The validation was restored in 0.55.1.•CVE-2026-89111

References

Sources include official advisories and independent security research.