CVE-2026-58249

EUVD-2026-98184

13.10.2026, 01:16

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

Wrap or Wraparound

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 23.51%

Common Weakness Enumeration

CWE-191 - Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Vulnerability Media Exposure

[GERMAN] SAP Patch-Day Oktober 2026: Drei HotNews und Korrekturen für S/4HANA
SAP hat zum Patch-Day im Oktober 21 neue und aktualisierte Sicherheitshinweise veröffentlicht. Darunter befinden sich drei HotNews-Hinweise, einer davon betrifft eine Code-Injection-Schwachstelle in S/4HANA. Die Onapsis Research Labs waren an der Behebung von zehn Schwachstellen beteiligt. Der Beitrag SAP Patch-Day Oktober 2026: Drei HotNews und Korrekturen für S/4HANA erschien zuerst auf All About Security Das Online-Magazin zu Cybersecurity (Cybersicherheit). Ransomware, Phishing, IT-Sicherheit, Netzwerksicherheit, KI, Threats, DDoS, Identity & Access, Plattformsicherheit .
Published: 2026-10-14T10:56:18+00:00

References

https://me.sap.com/notes/3765424

https://url.sap/sapsecuritypatchday