CVE-2026-58249

Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

High7.5EPSS 0.41%

Published: 13 Oct 2026
Updated: 13 Oct 2026
Reserved: 29 Jun 2026
Assigned by: sap

Description

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

Scores

CVSS scores of CVE-2026-58249, by who scored it
Scored by	CVSS	Score	Vector
sapCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Awaiting Analysis	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 0.41% · top 65% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

CWE-191: Integer Underflow (opens in a new tab)All about CWE-191 and its CVEs

Affected products

SAP_SE · SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
- affected HDB 2.00
- affected KRNL64UC 7.53
- affected WEBDISP 7.53
- affected 7.54
- affected 7.77
- affected 7.93
- affected 9.16
- affected XS_ADVANCED_RUNTIME 1.00
- affected SAP_EXTENDED_APP_SERVICES 1
- affected CONTSERV 7.53
- affected KERNEL 7.53
- affected 9.18
- affected 9.19
- affected 9.20

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-58249](https://trackcve.app/badge/CVE-2026-58249.svg)](https://trackcve.app/cve/CVE-2026-58249)

Record last updated 13 Oct 2026, 13:28 UTC.