CVE-2026-58240 – SAP NetWeaver (Message Server)
“When the Message Server trusts any component that knocks, every system behind it is open to whoever asks first.”
This update fixes a critical authentication flaw in SAP NetWeaver Message Server. CVE-2026-58240 has a CVSS score of 9.8, Critical severity. The Message Server does not properly check that internal application server components are genuine when they register. An unauthenticated attacker with network access to the service can register an unauthorized component and then perform unauthorized actions inside the application environment.
A successful attack has a high impact on the confidentiality, integrity, and availability of the affected system. SAP NetWeaver often runs core business processes, so a compromised Message Server puts critical operations and sensitive data at direct risk. Patch affected systems without delay.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-308