CVE-2026-58249

Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

State: Published
Severity: 7.5 High
Published: Oct 13, 2026
Updated: Oct 13, 2026
Reserved: Jun 29, 2026

Description

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	sap

Weaknesses

CWE-191 Integer Underflow

Affected Products

Product	Versions
SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)SAP_SE	HDB 2.00Affected KRNL64UC 7.53Affected WEBDISP 7.53Affected 7.54Affected 7.77Affected 7.93Affected 9.16Affected XS_ADVANCED_RUNTIME 1.00Affected SAP_EXTENDED_APP_SERVICES 1Affected CONTSERV 7.53Affected KERNEL 7.53Affected 9.18Affected 9.19Affected 9.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.