CVE-2026-58240

CRITICAL 9.8 ALL-YEARS

Published 2026-09-08 · Last modified 2026-09-09 · sap · NVD: Awaiting Analysis

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 44th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

9.8CVSS 3.1 · CRITICAL · CNA

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Sap Se

Products Sap Netweaver (Message Server)

Weakness (CWE)

CWE-308: : Use of Single-factor Authentication

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

All CVSS metrics

CRITICAL 9.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CRITICAL 9.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72575 ADVISORYEUVD · EUVD-2026-72575

Technical & other

https://me.sap.com/notes/3759472CVE record · sap · Updated 2026-09-08T00:10:55.418Z
NVD · CVE-2026-58240 · Updated 2026-09-09T05:17:26.417
https://url.sap/sapsecuritypatchdayCVE record · sap · Updated 2026-09-08T00:10:55.418Z
NVD · CVE-2026-58240 · Updated 2026-09-09T05:17:26.417

Sources: NVD · CVE.org · All sources and attribution · EPSS