What is the CVSS score of CVE-2026-58246?

CVE-2026-58246 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

SAP NetWeaver ABAP CVE-2026-58246

EUVD-2026-49738 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-28 cna@sap.com

GHSA-h2jw-cxmg-w6mx

SAP Information Disclosure

4.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Adjacent network, high privileges, user interaction; only confidentiality impacted.

3.1 AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:H/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 10:32 vuln.today

CVE Published

Jul 28, 2026 - 10:16 nvd

MEDIUM 4.3

DescriptionCVE.org

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

AnalysisAI

Information disclosure in SAP NetWeaver AS for ABAP and ABAP Platform allows a privileged user who activates diagnostic tracing to leak session identifiers into trace output. An attacker with access to the trace data can obtain those identifiers and impersonate legitimate users during their validity period. No public exploit or active exploitation has been reported.

Technical ContextAI

SAP NetWeaver Application Server for ABAP includes a diagnostic tracing feature used for troubleshooting by administrators. The vulnerability (CWE-497) arises because sensitive session identifiers are written into the trace file without adequate sanitization. The CPE data indicates affected products include the SAP NetWeaver ABAP platform components. The root cause is the exposure of sensitive system information to an unauthorized control sphere due to improper handling of output data.

RemediationAI

Apply the security patch provided by SAP through note 3413033 (https://me.sap.com/notes/3413033). As a workaround, restrict access to diagnostic trace files to only authorized administrators and disable tracing when not actively troubleshooting. The trade-off is reduced diagnostic capability during incidents. For systems already patched, verify that the fix prevents logging of session identifiers even when tracing is enabled.