CVE-2026-58246CWE-497

Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Medium · published July 28, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-07-28T09:51Z
EPSS history
Timeline
  • 28 JUL 09:51Z
    Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
    cvelistv5