CVE-2026-58236

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3745182
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP NetWeaver Servidor de Aplicaciones ABAP y Plataforma ABAP permiten a un atacante con altos privilegios eludir controles de seguridad ausentes en una ruta de código interna que conduce a la ejecución de comandos del sistema operativo. La explotación exitosa podría permitir al atacante ejecutar comandos a nivel de sistema operativo que escriben en el sistema operativo o detener el sistema SAP, lo que resulta en ningún impacto en la confidencialidad, bajo impacto en la integridad y alto impacto en la disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-58236

Mitre link : CVE-2026-58236

CVE.ORG link : CVE-2026-58236

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-58236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58236", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:22:20.811006Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server ABAP and ABAP Platform", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:21.553", "references": [{"url": "https://me.sap.com/notes/3745182", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability."}, {"lang": "es", "value": "SAP NetWeaver Servidor de Aplicaciones ABAP y Plataforma ABAP permiten a un atacante con altos privilegios eludir controles de seguridad ausentes en una ruta de c\u00f3digo interna que conduce a la ejecuci\u00f3n de comandos del sistema operativo. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar comandos a nivel de sistema operativo que escriben en el sistema operativo o detener el sistema SAP, lo que resulta en ning\u00fan impacto en la confidencialidad, bajo impacto en la integridad y alto impacto en la disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}