SAP Web Dispatcher EUVD-2026-72585

Exploitation requires a valid SAP account at the low-privilege tier (PR:L confirmed by CVSS vector) - any authenticated user with basic system access qualifies, with no elevated or administrative role needed. The attacker must have network-layer access to the SAP Web Dispatcher, ICM, or Content Server HTTP/HTTPS administrative interface, which is typically exposed on the internal corporate network. No special non-default configuration is required; the vulnerability is present in default deployments. Limiting factors include: (1) a valid credential is required - purely unauthenticated exploitation is not possible per the CVSS PR:L metric; (2) the administrative interface must be reachable from the attacker's network position, so edge deployments with strict network segmentation reduce exposure; (3) impact is confined to confidentiality - no direct write or execution path is established by this vulnerability alone.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), accurately reflecting that exploitation requires a valid low-privileged account but imposes no other barriers - no complexity, no user interaction. The high confidentiality impact (C:H) is notable: system state data from SAP core components (hostnames, port bindings, connection pool states, trace levels, potentially credentials in config dumps) can meaningfully accelerate follow-on attacks such as privilege escalation or lateral movement within an SAP landscape. No EPSS score was provided in the input data, and the vulnerability is absent from CISA KEV, suggesting no confirmed active exploitation at analysis time. However, the low bar for exploitation means any organization where developer, consultant, or service accounts have basic SAP access is exposed - even a mid-sized enterprise IT team should treat this as an actionable remediation item alongside SAP's quarterly patch cycle. The information-only impact (I:N/A:N) limits immediate blast radius but does not reduce the reconnaissance value of the disclosed data.

An attacker with a low-privileged SAP dialog or RFC service account - such as a developer, external consultant, or compromised internal user - sends HTTP requests directly to administrative interface paths on SAP Web Dispatcher or ICM. The server responds with system state data including kernel version details, active connections, trace configuration, and potentially sensitive environment parameters. The attacker uses this information to identify further attack surfaces or craft targeted exploits against the SAP environment.