SAP NetWeaver Message Server Vulnerability Affects Application Security
CVE-2026-58240

9.8CRITICAL

Key Information:

Vendor

SAP
Status
SAP Netweaver (message Server)
Vendor
CVE Published:
8 September 2026

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-58240?

The SAP NetWeaver Message Server has a security vulnerability related to inadequate verification of the authenticity of internal application server components during the registration process. An attacker with network access could exploit this flaw, leading to potential unauthorized registration of malicious components. This exploitation could result in unauthorized actions within the application environment, significantly affecting the system's confidentiality, integrity, and availability. It is essential for users to review security measures and apply the latest patches provided by SAP to mitigate this risk.

Affected Version(s)

SAP NetWeaver (Message Server) KERNEL 9.16

SAP NetWeaver (Message Server) 9.18

SAP NetWeaver (Message Server) 9.19

News Articles

favicon imageBleepingComputer

SAP warns of maximum severity 'OVERPASS' kernel vulnerability

SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code.

3 days ago

References

https://me.sap.com/notes/3759472
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.