CVE-2026-58246: Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Published Jul 28, 2026

Updated

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

Affected Software

1 affected component

SAP SAP NetWeaver Application Server for ABAP

Event History

Jul 28, 2026

CVE Published

via MITRE·09:51 AM

Data Sourced

via MITRE·09:51 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-58246?

The severity of CVE-2026-58246 is classified as medium with a score of 4.3.

How does CVE-2026-58246 allow for information disclosure?

CVE-2026-58246 allows for information disclosure by writing sensitive session identifier information into a diagnostic trace accessible to privileged users.

How can organizations mitigate CVE-2026-58246?

Organizations can mitigate CVE-2026-58246 by restricting access to diagnostic traces and ensuring they are not activated by unauthorized users.

Who is affected by CVE-2026-58246?

CVE-2026-58246 affects users of the SAP NetWeaver Application Server for ABAP and ABAP Platform.

What is the potential impact of CVE-2026-58246?

The potential impact of CVE-2026-58246 includes the risk of impersonation of legitimate users by obtaining sensitive session identifiers.