Search/CVE-2026-58240
● CVE — Critical

CVE-2026-58240

DiscoveredSep 8, 2026UpdatedSep 9, 2026

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

CVSS v3.1
9.8 CRITICAL
EPSS
0.53%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
2
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 9, 2026 → Sep 25, 2026
▲ 0.18pp
0.34% → 0.53% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
4 relationships
Timeline
disclosure → media coverage
Sep 8, 2026
Disclosure — published as a CVE record.
Sep 9, 2026
advisories.ncsc.nl reports: NCSC-2026-0356 [1.00] [M/H] Kwetsbaarheden verholpen in diverse SAP-producten
Sep 9, 2026
cert.europa.eu reports: 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server