CVE-2026-58246

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3413033
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) SAP NetWeaver Servidor de Aplicaciones para ABAP y Plataforma ABAP escribe información sensible de identificadores de sesión en una traza de diagnóstico cuando la traza es activada por un usuario privilegiado. Un atacante con acceso a los datos de traza resultantes podría obtener identificadores que permiten la suplantación de usuarios legítimos durante su período de validez. Esto conlleva un alto impacto en la confidencialidad. La integridad y la disponibilidad no se ven afectadas.

Information

Published : 2026-07-28 10:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-58246

Mitre link : CVE-2026-58246

CVE.ORG link : CVE-2026-58246

JSON object : View

Products Affected

No product.

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2026-58246", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58246", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T19:16:44.559113Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server for ABAP", "versions": [{"status": "affected", "version": "SAP_BASIS 740"}, {"status": "affected", "version": "SAP_BASIS 750"}, {"status": "affected", "version": "SAP_BASIS 751"}, {"status": "affected", "version": "SAP_BASIS 752"}, {"status": "affected", "version": "SAP_BASIS 753"}, {"status": "affected", "version": "SAP_BASIS 754"}, {"status": "affected", "version": "SAP_BASIS 755"}, {"status": "affected", "version": "SAP_BASIS 756"}, {"status": "affected", "version": "SAP_BASIS 757"}, {"status": "affected", "version": "SAP_BASIS 758"}, {"status": "affected", "version": "SAP_BASIS 795"}], "platforms": ["ABAP"], "defaultStatus": "unaffected"}]}], "published": "2026-07-28T10:16:49.943", "references": [{"url": "https://me.sap.com/notes/3413033", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period.\u00a0This leads to high impact on confidentiality. Integrity and availability are not impacted."}, {"lang": "es", "value": "SAP NetWeaver Servidor de Aplicaciones para ABAP y Plataforma ABAP escribe informaci\u00f3n sensible de identificadores de sesi\u00f3n en una traza de diagn\u00f3stico cuando la traza es activada por un usuario privilegiado. Un atacante con acceso a los datos de traza resultantes podr\u00eda obtener identificadores que permiten la suplantaci\u00f3n de usuarios leg\u00edtimos durante su per\u00edodo de validez. Esto conlleva un alto impacto en la confidencialidad. La integridad y la disponibilidad no se ven afectadas."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cna@sap.com"}