CVE-2026-58249: Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely by sending a specially crafted request to an affected SAP NetWeaver or SAP Web Dispatcher Internet Communication Manager instance. No user interaction or prior privileges are required.
What is the likely operational impact of exploitation?
Exploitation can cause the affected process to crash, creating a high availability impact for the affected application. The provided information indicates no confidentiality or integrity impact.
What should be prioritized during triage?
Identify SAP NetWeaver and SAP Web Dispatcher systems that expose the Internet Communication Manager to network requests, as these are the components named as affected. Review SAP Note 3765424 for vendor remediation guidance.