SAP NetWeaver Msg Server IDOR via Component Registration
CVE-2026-58240 Published on September 8, 2026
Missing Authentication check in SAP NetWeaver (Message Server)
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
Vulnerability Analysis
CVE-2026-58240 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Use of Single-factor Authentication
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy. The use of weak, reused, and common passwords is rampant on the internet. Without the added protection of multiple authentication schemes, a single mistake can result in the compromise of an account. For this reason, if multiple schemes are possible and also easy to use, they should be implemented and required.
Products Associated with CVE-2026-58240
Want to know whenever a new CVE is published for SAP NetWeaver? stack.watch will email you.
Affected Versions
SAP_SE SAP NetWeaver (Message Server):- Version KERNEL 9.16 is affected.
- Version 9.18 is affected.
- Version 9.19 is affected.
- Version 9.20 is affected.