CVE-2026-58246 — Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Description (CNA)

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver Application Server for ABAP	affected SAP_BASIS 740; affected SAP_BASIS 750; affected SAP_BASIS 751; affected SAP_BASIS 752; affected SAP_BASIS 753; affected SAP_BASIS 754; affected SAP_BASIS 755; affected SAP_BASIS 756; affected SAP_BASIS 757; affected SAP_BASIS 758; affected SAP_BASIS 795

CWE

CWE-497

References

https://me.sap.com/notes/3413033
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.