CVE-2026-58240

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue).

What to do: Apply the SAP NetWeaver Message Server fix from the September 2026 SAP Security Patch Day (referenced as advisory 2026-011) as a priority, since the flaw is unauthenticated and network-triggerable; check SAP's portal for the corrected builds applicable to your release, as no specific version numbers were provided in the source data. Until patching, restrict network access to the Message Server (typically TCP 36xx, e.g., 3600) to trusted application server hosts and internal networks, and verify no message server listener is reachable from the internet. Monitor SAP security notes for updates, as no public exploit exists today.