What is CVE-2026-58246?

CVE-2026-58246 is a medium-severity vulnerability in SAP Se Netweaver Application Server For Abap, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 4.3/10. Published 2026-07-28.

How severe is CVE-2026-58246?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in SAP Se Netweaver Application Server For Abap

CVE-2026-58246

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

EPSS: 0.002 (4.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.

Affected products

Sap_se Sap Netweaver Application Server For Abap — versions SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

Frequently asked questions

What is CVE-2026-58246?: CVE-2026-58246 is a medium-severity vulnerability in SAP Se Netweaver Application Server For Abap, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 4.3/10. Published 2026-07-28.
How severe is CVE-2026-58246?: Medium severity. CVSS v3 base score is 4.3 out of 10.