AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-58234

SAP Process Integration (SOAP Adapter): XML entity expansion

SAP

CVE-2026-58234 · Published Sep 8, 2026

Low2.2
No fix yet
SAP advisory

SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity.

Affected versions

PackageAffectedFixed in
SAP Process Integration (SOAP Adapter)
Product
<= MESSAGING 7.50No fix yet
<= SAP_XIAF 7.50No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-776

More SAP advisories

All SAP
Medium 4.3Sep 8SAP NetWeaver and ABAP Platform: missing authorizationCVE-2026-76963no fix yetHigh 7.8Sep 8SAP NetWeaver Business Client: code executionCVE-2026-76967no fix yetMedium 6.5Sep 8SAP Web Dispatcher, Internet: information disclosureCVE-2026-76968no fix yetCritical 9.4Sep 8SAP Cloud Application Programming Model (CAP): weakly protected credentialsCVE-2026-76969no fix yetMedium 6.5Sep 8SAP Manufacturing Integration and Intelligence: server-side request forgeryCVE-2026-76971no fix yetMedium 4.3Sep 8SAP UI5 does not sufficiently validate the parent frame's origin against the...CVE-2026-76977no fix yet