CVE-2026-58240

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.53%
EPSS Percentile: 44.99%
CISA KEV: Not listed

Description

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 08-Sep-2026 08:17
Last Modified: 09-Sep-2026 12:17
EPSS Date: 2026-11-09
CWE: CWE-308

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

SAP_SE · SAP NetWeaver (Message Server) Source: CNA · [email protected]
Default status: unaffected

KERNEL 9.16 — affected
9.18 — affected
9.19 — affected
9.20 — affected

References

Last enrichment sync: 09-Nov-2026 23:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

SAP also patched CVE-2026-58240 (S4GET) in the NetWeaver Message Server, a missing-authentication flaw that can expose entire SAP clusters to remote code execution. SAP Patches Critical OVERPASS Kernel Flaw and S4GET NetWeaver Vulnerability

CVE (2)

People (2)

Vendors (1)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.