Memory Handling Flaw in SAP NetWeaver and Web Dispatcher Affects Application Stability
CVE-2026-58249

7.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver And SAP Web Dispatcher (internet Communication Manager)
Vendor
CVE Published:
13 October 2026

What is CVE-2026-58249?

SAP NetWeaver and SAP Web Dispatcher are prone to a memory handling error due to inadequate field validation in specially crafted requests processed by an internal protocol component. An unauthenticated attacker can exploit this vulnerability by sending maliciously constructed requests, potentially resulting in serious disruptions to application availability as the affected process may crash. Importantly, this vulnerability does not compromise the confidentiality or integrity of the application.

Affected Version(s)

SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) HDB 2.00

SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) KRNL64UC 7.53

SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) WEBDISP 7.53

References

https://me.sap.com/notes/3765424
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.