CVE-2026-58249— Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
Quick assessment
Affected
SAP_SE SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP NetWeaver 和 SAP Web Dispatcher 未能正确验证由内部协议组件处理的特殊构造请求中的某些字段。未经身份验证的攻击者可以发送恶意请求，从而触发内存处理错误，导致受影响进程崩溃。因此，成功利用此漏洞会对受影响应用程序的可用性造成高影响。但该漏洞不会对应用程序的机密性或完整性产生影响。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58249
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
Source: CVE Program / CVE List V5
Vulnerability Description
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) | HDB 2.00 | - |
|
II. Public POCs for CVE-2026-58249
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58249
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2026-10-13 · 20 CVEs total
| CVE-2026-89111 | 10.0 CRITICAL | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python |
| CVE-2026-89107 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) |
| CVE-2026-89110 | 9.9 CRITICAL | Broken Access Control in SAP NetWeaver Visual Composer |
| CVE-2026-89108 | 9.1 CRITICAL | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati |
| CVE-2026-89113 | 8.8 HIGH | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) |
| CVE-2026-89120 | 7.1 HIGH | Missing authorization check in SAP ABAP Platform |
| CVE-2026-76972 | 6.5 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence |
| CVE-2026-89112 | 6.5 MEDIUM | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure |
| CVE-2026-89122 | 6.1 MEDIUM | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-76975 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) |
| CVE-2026-89117 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89116 | 5.9 MEDIUM | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code |
| CVE-2026-76976 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applica |
| CVE-2026-89118 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89121 | 4.7 MEDIUM | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) |
| CVE-2026-89106 | 4.4 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAPUI5 |
| CVE-2026-89124 | 4.3 MEDIUM | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Pr |
| CVE-2026-89105 | 4.2 MEDIUM | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra |
| CVE-2026-58242 | 3.5 LOW | Improper Authorization check in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89124
Missing Authorization Check in SAP Global Trade Services, ed -
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Man -
CVE-2026-89120
Missing authorization check in SAP ABAP Platform -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp
Same weakness: CWE-191
-
CVE-2026-58242
Improper Authorization check in SAP Cloud Connector -
CVE-2026-109246
FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame -
CVE-2026-107794
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl -
CVE-2013-10076
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Per -
CVE-2026-106429
Application denial of service via malformed KMS endpoint in
V. Comments for CVE-2026-58249
No comments yet