CVE-2026-58246

MEDIUM

SAP NetWeaver ABAP Platform - Diagnostic Trace Session Identifier Disclosure

Title source: manual

Description

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

References (2)

Core 2

Core References

https://me.sap.com/notes/3413033

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 4.3

EPSS 0.0015

EPSS Percentile 4.7%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-497

Status published

Products (11)

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 740

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 750

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 751

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 752

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 753

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 754

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 755

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 756

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 757

SAP_SE/SAP NetWeaver Application Server for ABAP SAP_BASIS 758

... and 1 more

Published Jul 28, 2026

Tracked Since Jul 28, 2026