Session Identifier Exposure in SAP NetWeaver Application Server for ABAP

CVE-2026-58246

What is CVE-2026-58246?

The SAP NetWeaver Application Server for ABAP and ABAP Platform inadvertently exposes sensitive session identifier information in a diagnostic trace when activated by a privileged user. An attacker with access to this diagnostic trace can retrieve session identifiers, which may allow them to impersonate legitimate users, compromising user confidentiality during the session's validity period. This represents a significant risk for organizations using this product, necessitating immediate awareness and proactive measures to mitigate potential security breaches.

References