CVE-2026-58240

Published Sep 8, 2026

Last updated 2 days ago

CVSS critical 9.8
SAP

Overview

Description
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Source
cna@sap.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

cna@sap.com
CWE-308

Social media

Hype score
Not currently trending

  1. News: SAP Patch Day: OVERPASS CVE-2026-44756 max-severity kernel EPP overflow lets unprivileged actors get admin on SAP via ICM. Onapsis: 10k+ internet-facing. Also S4GET CVE-2026-58240 unauth Message Server RCE. Patch Sep notes now. https://t.co/l1a1JEeOEJ

    @snakeyesV1

    8 Sept 2026

    97 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-44756 CVE-2026-75650 CVE-2026-86296 CVE-2026-18922 CVE-2026-58240 ..🧵👇

    @exploitgrid

    8 Sept 2026

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric. September patch day: CVE-2026-44756 and CVE-2026-58240. No exploitation reported. https://t.co/5vpeh6itnD

    @severitydaily

    8 Sept 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacke… https://t.co/46T6olyz9m

    @CVEnew

    8 Sept 2026

    1082 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.•CVE-2026-76969
  2. SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system.•CVE-2026-66768
  3. A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.•CVE-2026-44756
  4. SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.•CVE-2026-58231
  5. SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.•CVE-2026-34265

References

Sources include official advisories and independent security research.