CVE-2026-58249 — Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

Description (CNA)

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)	affected HDB 2.00; affected KRNL64UC 7.53; affected WEBDISP 7.53; affected 7.54; affected 7.77; affected 7.93; affected 9.16; affected XS_ADVANCED_RUNTIME 1.00; affected SAP_EXTENDED_APP_SERVICES 1; affected CONTSERV 7.53; affected KERNEL 7.53; affected 9.18; affected 9.19; affected 9.20

CWE

CWE-191

References

https://me.sap.com/notes/3765424
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.