SAP NetWeaver CVE-2026-58241

Exploitation requires: (1) a valid low-privileged SAP user account with at least basic access to the CTS Customer Transport Integration Wizard (PR:L per CVSS vector); (2) the attack must occur during specific operations within the wizard - the AC:H metric explicitly indicates that a special condition or operational state must be present, meaning the attack cannot be reliably triggered on demand against an idle system. No victim user interaction is required (UI:N). Limiting factors: the High Attack Complexity (AC:H) is the primary constraint - exploitation is not straightforwardly repeatable and requires timing or specific system state; organizations that restrict CTS wizard access strictly to dedicated transport administrators via SAP authorization roles eliminate the attack surface entirely; no confidentiality impact means data exfiltration is not a concern; the Unchanged scope (S:U) means lateral movement or impact to adjacent systems is not a realistic outcome from this flaw alone.

The vendor-assigned CVSS 4.2 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the constrained real-world risk. The High Attack Complexity (AC:H) is the most significant limiting factor: exploitation is only possible during specific operational states of the CTS wizard, meaning the attack cannot be reliably automated or opportunistically triggered at will. Low privileges (PR:L) further reduce the attack surface to authenticated SAP users with CTS access. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from this dataset. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, aligning with the modest CVSS score. The impact is bounded - confidentiality is entirely unaffected, and the integrity and availability impacts are low (configuration table tampering leading to transport delays, not system compromise). For most organizations, this is a genuine but low-urgency patching item; organizations with strict change control requirements or high-volume SAP transport activity may assign higher operational priority due to potential process disruption.

A low-privileged SAP user with standard system access authenticates to the SAP environment and navigates to the Change and Transport System's Customer Transport Integration Wizard. During a specific operational phase of the wizard - the precise trigger condition implied by the AC:H metric - the user exploits the missing authorization check to write to configuration tables governing data object access, potentially misconfiguring transport routes or access permissions. The result is processing delays or operational disruption to the change management pipeline, though no data can be extracted and the attacker cannot escalate to further system compromise.