CVE-2026-58243

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3772411
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP ABAP Development Tools no realiza las comprobaciones de autorización necesarias para cierta funcionalidad, permitiendo a un atacante con privilegios bajos ejecutar operaciones de base de datos no autorizadas contra SAP NetWeaver AS ABAP. Una explotación exitosa podría permitir al atacante leer datos sensibles, modificar datos de la aplicación y perturbar el acceso para usuarios legítimos, lo que resulta en un alto impacto en la confidencialidad, integridad y disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-58243

Mitre link : CVE-2026-58243

CVE.ORG link : CVE-2026-58243

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-58243", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58243", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP ABAP Developer Tools", "versions": [{"status": "affected", "version": "SAP_BASIS 750"}, {"status": "affected", "version": "SAP_BASIS 751"}, {"status": "affected", "version": "SAP_BASIS 752"}, {"status": "affected", "version": "SAP_BASIS 753"}, {"status": "affected", "version": "SAP_BASIS 754"}, {"status": "affected", "version": "SAP_BASIS 755"}, {"status": "affected", "version": "SAP_BASIS 756"}, {"status": "affected", "version": "SAP_BASIS 757"}, {"status": "affected", "version": "SAP_BASIS 758"}, {"status": "affected", "version": "SAP_BASIS 816"}, {"status": "affected", "version": "SAP_BASIS 918"}, {"status": "affected", "version": "SAP_BASIS 920"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:22.160", "references": [{"url": "https://me.sap.com/notes/3772411", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability."}, {"lang": "es", "value": "SAP ABAP Development Tools no realiza las comprobaciones de autorizaci\u00f3n necesarias para cierta funcionalidad, permitiendo a un atacante con privilegios bajos ejecutar operaciones de base de datos no autorizadas contra SAP NetWeaver AS ABAP. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante leer datos sensibles, modificar datos de la aplicaci\u00f3n y perturbar el acceso para usuarios leg\u00edtimos, lo que resulta en un alto impacto en la confidencialidad, integridad y disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}