Medium severity · published Aug 11, 2026
CVE-2026-58236
OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server ABAP and ABAP Platform · SAP_SE
KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; KERNEL 7.22; 7.54; +3 more · source: vendor
Affected product
SN
SAP NetWeaver Application Server ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58236
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58236
me.sap.com
https://me.sap.com/notes/3745182
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver Application Server ABAP and ABAP Platform
9.6
CVE-2026-0509
Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
8.1
CVE-2026-0506
Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
6.2
CVE-2025-31329
Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
6.1
CVE-2025-42969
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform