CVE-2026-58249CWE-191

CVE-2026-58249

High · published October 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00322 · 23.9th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2026-10-13T05:16Z
References (2)
https://me.sap.com/notes/3765424 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 14 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 13 OCT 00:22Z
    Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
    cvelistv5
  • 13 OCT 00:22Z
    Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
    cvelistv5