What is the CVSS score of EUVD-2026-55867?

EUVD-2026-55867 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

SAP NetWeaver ADS EUVD-2026-55867

| CVE-2026-58235 MEDIUM

Dependency on Vulnerable Third-Party Component (CWE-1395)

2026-08-11 sap

GHSA-rh7g-h899-r9jq

Java Information Disclosure SAP Adobe Sap Netweaver As Java Adobe Document Services Sap Se

6.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-facing ADS endpoint, authenticated low-privilege attacker, no interaction needed; low uniform impact with no scope change aligns with outdated library weakness.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:06 vuln.today

DescriptionCVE.org

SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.

AnalysisAI

SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.

Technical ContextAI

CWE-1395, 'Dependency on Vulnerable Third-Party Component,' describes the root cause: the SAP NetWeaver AS Java ADS component bundles aging open-source libraries for cryptographic operations and data transfer rather than consuming maintained, patched versions. These embedded libraries contain previously disclosed and fixed vulnerabilities in their upstream projects, but SAP's packaging has not incorporated those upstream fixes. The CPE cpe:2.3:a:sap_se:sap_netweaver_as_java_(adobe_document_services):*:*:*:*:*:*:*:* encompasses the ADSSAP 7.50 release confirmed by EUVD-2026-55867. Adobe Document Services within SAP NetWeaver AS Java is responsible for PDF generation, forms processing, and digital signature workflows; cryptographic and data-transport library weaknesses in this component could expose document confidentiality, integrity of generated documents, or service availability depending on which specific library paths an attacker triggers.

RemediationAI

Apply SAP Security Note 3758318 (https://me.sap.com/notes/3758318), which addresses the outdated library dependencies in the ADS component; no specific patched version number was independently confirmable from available data, so follow the note's instructions precisely. Monitor SAP Security Patch Day (https://url.sap/sapsecuritypatchday) for updated guidance. If immediate patching is not feasible, restrict network access to the ADS component to only authorized internal SAP application servers and administrative networks, reducing exposure to the PR:L attack surface; note this workaround does not eliminate the vulnerability and may impact PDF and forms workflows. Disabling the ADS component entirely is a stronger compensating control if document services are not actively required, though it will break PDF generation and digital signature features dependent on ADS. There is no evidence a vendor-named patch version beyond 'apply SAP Note 3758318' has been published.