SAP NetWeaver ADS CVE-2026-58235

The attacker must hold a valid SAP NetWeaver account with at least low-privilege access (PR:L per CVSS vector) - anonymous or unauthenticated exploitation is not supported by the available data. The Adobe Document Services component (ADSSAP 7.50) must be installed and network-accessible on the target SAP NetWeaver AS Java instance; ADS is not always deployed in every SAP landscape. No specific non-default configuration is required beyond ADS being present. Limiting factors: authentication requirement eliminates opportunistic external attackers; scope is unchanged (S:U), meaning exploitation does not cascade to the broader SAP system; impact is low across all three pillars; and no specific exploit technique has been identified, requiring attacker knowledge of which library functions are reachable through ADS APIs.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L scores 6.3 (Medium), reflecting network reachability and low exploitation complexity but tempered by authentication requirements (PR:L) and a low, non-escalating impact profile (S:U, C:L/I:L/A:L). No EPSS score was provided in the source intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog, and no POC or in-the-wild exploitation has been identified. The SSVC exploitation status is effectively 'none' at this time. The primary real-world risk driver is that SAP NetWeaver deployments are common in large enterprises and ADS may be directly network-accessible; however, the authentication requirement (PR:L) substantially narrows the attacker population to insiders or already-compromised accounts. This is best treated as a mandatory patching item during the next SAP patch cycle rather than an emergency response trigger. The vague library specification - SAP has not named the exact libraries - means defenders cannot independently verify which CVEs are transitively embedded, which is a gap in confidence.

A low-privileged authenticated SAP user or service account with network access to the NetWeaver AS Java ADS endpoint submits a crafted document-processing request that triggers a vulnerable code path within one of the outdated bundled libraries - for example, a cryptographic routine with a known weakness - resulting in partial disclosure of processed document content or limited service instability. No public POC exists for this specific CVE, so exploitation would require an attacker with knowledge of the underlying library vulnerabilities and how they surface through the ADS API.