CVE-2026-58249Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
- 7.5HighCVSS base score
- 0.41%Exploitation in 30 daysEPSS · top 65% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Timeline
ID reserved
By sap
- 4 months later
· 4 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| sapCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.41% · top 65% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
SAP_SE · SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
- affected HDB 2.00
- affected KRNL64UC 7.53
- affected WEBDISP 7.53
- affected 7.54
- affected 7.77
- affected 7.93
- affected 9.16
- affected XS_ADVANCED_RUNTIME 1.00
- affected SAP_EXTENDED_APP_SERVICES 1
- affected CONTSERV 7.53
- affected KERNEL 7.53
- affected 9.18
- affected 9.19
- affected 9.20
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-98184 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-58249)Record last updated .