{"id":"CVE-2026-58249","title":"SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component","summary":"SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handl…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-191"],"vendor":"SAP_SE","product":"SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)","affected":["sap_netweaver_and_sap_web_dispatcher_internet_communication_manager HDB 2.00","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager KRNL64UC 7.53","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager WEBDISP 7.53","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 7.54","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 7.77","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 7.93","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 9.16","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager XS_ADVANCED_RUNTIME 1.00","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager SAP_EXTENDED_APP_SERVICES 1","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager CONTSERV 7.53","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager KERNEL 7.53","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 9.18","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 9.19","sap_netweaver_and_sap_web_dispatcher_internet_communication_manager 9.20"],"published":"2026-10-13","updated":"2026-10-15","sourceUpdated":"2026-10-15T20:38:04.303","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58249","references":[{"url":"https://me.sap.com/notes/3765424","label":"cna@sap.com"},{"url":"https://url.sap/sapsecuritypatchday","label":"cna@sap.com"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00406,"epssPercentile":0.34695,"exploits":{"github":1,"githubRepos":["https://github.com/Toluwanimi7/CYB401-CVE-2026-58249-Analysis"],"checkedAt":"2026-10-27T18:12:44.914Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-13T13:12:46.398402Z"},"ingestedAt":"2026-10-13T02:12:00.758Z","slug":"CVE-2026-58249","body":"## Overview\n\nSAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":227646,"id":"CVE-2026-58249","ts":1792692575477,"field":"exploit_available","old":"false","new":"true"}]}