CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)
Unauthenticated attackers can register unauthorized components in SAP NetWeaver Message Server, leading to unauthorized actions and high impact on system confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58240?
CVE-2026-58240 is a critical authentication bypass vulnerability in SAP_SE SAP NetWeaver (Message Server), published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Weakness: CWE-308
Which versions are affected by CVE-2026-58240?
How do I fix CVE-2026-58240?
No fix has been published for CVE-2026-58240 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-58240 being exploited?
There is no known exploitation of CVE-2026-58240 in the wild and no public exploit code.
Sources
Also known as GHSA-wcwm-g7vg-pg73.