CVE-2026-58240
Lets attacker register unauthorized components in SAP NetWeaver Message Server
A missing authentication check in SAP NetWeaver Message Server allows an unauthenticated attacker to register a fake application server component. This can lead to unauthorized actions affecting confidentiality, integrity, and availability. The vulnerability is critical but not yet known to be exploited in the wild; no fix has been released.
SAP_SE SAP NetWeaver (Message Server) · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.8 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- No fix is available yet. Consult the CERT-EU advisory 2026-011 for mitigation recommendations.
What happened
- 28 OctCERT-EU publishes advisory 2026-011 covering critical vulnerabilities in SAP Kernel and NetWeaver Message Server.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-58240 | Missing Authentication check in SAP NetWeaver (Message Server) | critical 9.8 | No | 0.5% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
CERT-EU2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server ↗The records
CVE-2026-58240 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works