AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-58246

SAP NetWeaver Application Server for ABAP: system information exposure

SAP

CVE-2026-58246 · Published Jul 28, 2026

Medium4.3
No fix yet
SAP advisory

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

Affected versions

PackageAffectedFixed in
SAP NetWeaver Application Server for ABAP
Product
<= SAP_BASIS 740No fix yet
<= SAP_BASIS 750No fix yet
<= SAP_BASIS 751No fix yet
<= SAP_BASIS 752No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-497

More SAP advisories

All SAP
Critical 9.1Jul 14SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented...CVE-2026-44761no fix yetMedium 6.1Jul 14SAP @ui5/webcomponents-base: clickjackingCVE-2026-44767no fix yetMedium 4.1Jul 14SAP WebClient UI: attacker could injectCVE-2026-44768no fix yetMedium 5.5Jul 14SAP S/4HANA Project Management (PPM-PRO): SQL injectionCVE-2026-44769no fix yetMedium 4.3Jul 14SAP S/4 HANA (Create Single Payment): missing authorizationCVE-2026-44770no fix yetMedium 4.3Jul 14SAP S/4HANA (Draft operation): privilege escalationCVE-2026-44771no fix yet