SAP ABAP Developer Tools CVE-2026-58243

Exploitation requires a valid, low-privilege SAP account (PR:L as confirmed by the CVSS vector) and network-level access to the target SAP NetWeaver AS ABAP instance. The attacker must use or interact with SAP ABAP Developer Tools functionality - the vulnerability is specific to the ADT-exposed interface layer, meaning the target system must have ADT services enabled and accessible. The affected SAP_BASIS support package must be one of the 12 confirmed levels (750-758, 816, 918, 920). Exploitation is limited to authenticated sessions; unauthenticated remote exploitation is not supported by the PR:L vector. The attack does not require elevated SAP roles or administrative privileges - any standard user with ADT connectivity can trigger the flaw. There is no indication of a non-default configuration requirement from available data.

The CVSS 3.1 score of 8.8 (High) is supported by a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: the vulnerability is reachable over the network with low attack complexity, requires only a standard (low-privilege) SAP login, and yields full impact across all three security pillars. These signals collectively indicate that any organizational insider or compromised low-privilege account with ADT access can pivot to unauthorized database control - a significant lateral movement and data exfiltration vector. EPSS data was not supplied in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists and no public exploit code has been identified, which moderates immediate urgency; however, the broad SAP_BASIS version range (12 distinct support package levels spanning a major release delta) means the attack surface is very wide across SAP landscapes. The 'Authentication Bypass' tag in the source intelligence is somewhat misleading - the CVSS PR:L vector confirms authentication IS required, but the authorization layer is bypassed post-login. Organizations should prioritize this for internal threat modeling and patch scheduling given the insider-threat and supply-chain-account-compromise risk profile.

An attacker with a standard, low-privileged SAP user account - such as a developer account, a service account, or a compromised end-user credential - connects to a SAP NetWeaver AS ABAP system using the SAP ABAP Developer Tools Eclipse plugin. By invoking a specific ADT-exposed functionality that lacks an authorization gate, the attacker directly issues database-layer operations, reading sensitive business records (e.g., HR, finance, or customer data), altering application data to manipulate business processes, or deleting records to deny access to legitimate users. No public exploit code has been identified, but the straightforward nature of CWE-862 (simply calling the unprotected functionality) means exploitation does not require advanced tooling.