CVE-2026-58236
OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
- State
- Published
- Severity
- 5.5 Medium
- Published
- Aug 11, 2026
- Updated
- Aug 11, 2026
- Reserved
- Jun 29, 2026
Description
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H | sap |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected Products
| Product | Versions |
|---|---|
SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.