What is the CVSS score of CVE-2026-58247?

CVE-2026-58247 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

SAP ABAP Platform CVE-2026-58247

EUVD-2026-55876 MEDIUM

Use of Uninitialized Resource (CWE-908)

2026-08-11 sap

GHSA-phvr-q87c-6vf7

Information Disclosure SAP Sap Abap Platform Sap Se

5.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with only low confidentiality leakage of residual memory; no integrity or availability impact per vendor description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:09 vuln.today

CVE Published

Aug 11, 2026 - 00:17 cve.org

MEDIUM 5.3

DescriptionCVE.org

SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application.

AnalysisAI

Memory disclosure in SAP ABAP Platform exposes residual data from previously allocated memory buffers to unauthenticated remote attackers via a specially crafted request to an internal component. Affected deployments include ABAP Platform 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77, with the vendor characterizing the leaked data as limited and non-sensitive. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, consistent with the moderate CVSS 5.3 rating reflecting low confidentiality impact with no integrity or availability consequences.

Technical ContextAI

CWE-908 (Use of Uninitialized Resource) indicates that memory buffers within the SAP ABAP Platform server stack are not properly zeroed or sanitized before reuse, causing stale contents from prior allocations to leak in server responses to crafted requests. The CPE cpe:2.3:a:sap_se:sap_abap_platform:*:*:*:*:*:*:*:* covers multiple kernel variants of the ABAP Platform, SAP's proprietary enterprise application server underpinning S/4HANA and classic ERP deployments. The affected internal component is reachable over the network without authentication, suggesting it is exposed via the ABAP application server's HTTP/HTTPS or ICM (Internet Communication Manager) interface. The vulnerability class is related to memory safety - adjacent to Heartbleed-style read-overrun bugs - though bounded here to non-sensitive residual data per the vendor's characterization.

RemediationAI

Apply the patch issued by SAP under Security Note 3756674 (https://me.sap.com/notes/3756674), distributed through the SAP Security Patch Day program (https://url.sap/sapsecuritypatchday). Exact target kernel build levels for affected versions 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77 are not independently confirmed in available data - consult the SAP note directly to identify the required kernel patch level for your landscape and validate with your SAP Basis team. As a compensating control while patching is scheduled, restrict network-layer access to the ABAP application server's HTTP/HTTPS ports (default 8000/443) to trusted internal IP ranges via firewall ACLs or SAP's own access control lists in the ICM configuration (icm/host_name_full and relevant profile parameters); note this may disrupt remote user access and integration endpoints, so scope carefully. Disabling the specific internal component is not feasible without SAP guidance, as it is not a user-configurable feature.