CVE-2026-58236: OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58236?
The severity of CVE-2026-58236 is medium, rated at 5.5.
What is CVE-2026-58236?
CVE-2026-58236 is an OS Command Injection vulnerability in the Application Server ABAP of SAP NetWeaver and ABAP Platform that allows high-privilege attackers to execute OS-level commands.
How do I fix CVE-2026-58236?
To fix CVE-2026-58236, ensure you apply the latest security patches provided by SAP as detailed in the official documentation.
Who is affected by CVE-2026-58236?
CVE-2026-58236 affects users of SAP NetWeaver Application Server ABAP and SAP ABAP Platform who have not implemented necessary security measures.
What can an attacker do with CVE-2026-58236?
An attacker exploiting CVE-2026-58236 can execute operating system commands due to the lack of proper security controls.