CVE-2026-58236 OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
High-privilege attackers can execute OS commands via an internal code path, impacting system availability and integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58236?
CVE-2026-58236 is a medium-severity command injection vulnerability in SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform, published on 11 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
Weakness: CWE-78
Which versions are affected by CVE-2026-58236?
How do I fix CVE-2026-58236?
No fix has been published for CVE-2026-58236 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-58236 being exploited?
There is no known exploitation of CVE-2026-58236 in the wild and no public exploit code.
Sources
Also known as GHSA-9gvf-fp5r-4gqr.