CVE-2026-58243
Received Received - Intake

Authorization Bypass in SAP ABAP Development Tools

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: SAP SE

Description
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-58243
EUVD
EUVD-2026-55873

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sap abap_development_tools *
sap netweaver_as_abap *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SAP ABAP Development Tools allows attackers with low privileges to bypass authorization checks and perform unauthorized database operations on SAP NetWeaver AS ABAP. It enables reading sensitive data, modifying application data, and disrupting legitimate user access, leading to high impacts on confidentiality, integrity, and availability.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized database operations in SAP NetWeaver AS ABAP. Review SAP system logs for unusual queries or modifications. Use transaction codes like ST01 (Workload Monitor) or SM19/SM20 (Security Audit Log) to monitor suspicious activities. Ensure proper authorization checks are enforced in ABAP Development Tools.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data, modification of critical application data, and disruption of services for legitimate users. This may lead to data breaches, financial loss, operational disruptions, and reputational damage.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or protected health information, resulting in potential data breaches and regulatory penalties.

Mitigation Strategies

Apply SAP security notes or patches addressing authorization checks in SAP ABAP Development Tools. Restrict user privileges to minimum required levels. Monitor database operations for unauthorized access attempts. Review and update SAP NetWeaver AS ABAP authorization profiles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart