SAP NetWeaver CVE-2026-58240

Requires network reachability to the SAP NetWeaver Message Server's internal registration service (the internal Message Server port), which is intended to be confined to the internal application server segment; there is no authentication requirement (PR:N) and no user interaction (UI:N). Exploitation is limited primarily by network segmentation: deployments that firewall the internal Message Server port to trusted instance hosts, or that enforce a restrictive Message Server ACL (ms/acl_info), substantially constrain the attack, whereas flat or internet-exposed Message Server ports permit unauthenticated exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with total impact - the maximum practical risk profile, consistent with SAP's own assessment. The key real-world modifier is network exposure: the internal Message Server port is intended to be segregated from end users, so environments that correctly firewall it to the internal instance subnet substantially reduce exposure, whereas flat networks or internet-exposed Message Servers face genuine unauthenticated compromise. Because SAP systems are high-value ERP targets, any operator - from a large enterprise to a mid-sized regional deployment - should treat a 9.8 Message Server flaw as urgent patching priority. No EPSS score, CISA KEV listing, or public proof-of-concept was provided, so exploitation likelihood cannot be quantified from the input; the 9.8 reflects potential impact, not confirmed active exploitation, and the internal-port-exposure precondition means it is likely opportunistic-against-exposed-systems rather than trivially mass-exploitable everywhere.

An attacker who can reach the internal Message Server port from an adjacent or misconfigured/exposed network sends a crafted registration request impersonating a legitimate application server instance. Lacking authenticity validation, the Message Server accepts the rogue component, letting the attacker join the landscape to intercept or redirect traffic and influence application behavior. No public proof-of-concept was included in the provided intelligence.