CVE-2026-58235: SAP NetWeaver Information Disclosure Flaw

CVE-2026-58235 Overview

CVE-2026-58235 affects SAP NetWeaver Application Server Java, specifically the Adobe Document Service component. The component ships with outdated open source cryptographic and data transfer libraries that contain known, previously disclosed vulnerabilities addressed in later releases of those libraries.

A low-privileged authenticated attacker on the network can potentially leverage these embedded weaknesses against the affected component. Successful exploitation can result in low impact on confidentiality, integrity, and availability of the SAP system.

Critical Impact
An authenticated attacker with low privileges can reach the Adobe Document Service over the network and abuse known flaws in bundled third-party libraries to affect confidentiality, integrity, and availability.

Affected Products

SAP NetWeaver Application Server Java
Adobe Document Service (ADS) component within SAP NetWeaver AS Java
Deployments using the bundled outdated cryptographic and data transfer libraries referenced in SAP Note #3758318

Discovery Timeline

2026-08-11 - CVE-2026-58235 published to the National Vulnerability Database (NVD)
2026-08-11 - SAP publishes SAP Note #3758318 as part of SAP Security Patch Day
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-58235

Vulnerability Analysis

The Adobe Document Service (ADS) in SAP NetWeaver Application Server Java processes documents such as interactive forms and PDF output. To perform this work, ADS depends on several bundled open source libraries, including cryptographic primitives and data transfer components.

The libraries shipped with the affected releases are outdated. Newer upstream versions of these libraries have fixed multiple publicly disclosed vulnerabilities. Because SAP NetWeaver AS Java continues to load the older versions, applications served by ADS inherit those known flaws.

The attack surface is limited to authenticated users. An attacker needs valid credentials with low privileges on the SAP system before targeting the component. The vulnerability class is best described as use of components with known vulnerabilities, mapped to [CWE-1104].

Root Cause

The root cause is dependency drift. Third-party cryptographic and data transfer libraries embedded in the Adobe Document Service were not upgraded in step with their upstream security releases. Each known flaw in those libraries becomes reachable through ADS request handling paths.

Attack Vector

Exploitation requires network access to the SAP NetWeaver AS Java instance and valid authentication with low privileges. The attacker interacts with the Adobe Document Service through its standard document-processing interfaces and supplies inputs that exercise vulnerable code paths within the outdated bundled libraries.

No public exploit is currently associated with CVE-2026-58235. The Exploit Prediction Scoring System (EPSS) probability is 0.174% at the 7.08 percentile as of 2026-08-13, indicating low near-term exploitation likelihood. Refer to the SAP Note #3758318 for the definitive list of libraries and fixed versions.

Detection Methods for CVE-2026-58235

Indicators of Compromise

Unexpected Adobe Document Service (ADS) requests originating from low-privileged SAP user accounts outside normal business processes.
Abnormal ADS worker process behavior, including unusual outbound network connections or child process creation on the SAP NetWeaver AS Java host.
Errors or stack traces in ADS logs referencing the bundled cryptographic or data transfer libraries during document rendering.

Detection Strategies

Inventory the ADS installation and compare loaded library versions against the fixed versions listed in SAP Note #3758318.
Enable SAP NetWeaver AS Java security auditing for ADS endpoints and forward logs to a SIEM for correlation with authentication events.
Baseline normal ADS request patterns per user and alert on deviations, particularly unusual document payloads submitted by low-privileged accounts.

Monitoring Recommendations

Monitor ADS process telemetry for anomalous file, network, and memory activity on SAP NetWeaver AS Java hosts.
Track SAP Security Patch Day advisories and cross-reference deployed patch levels against the fixed release referenced by SAP Note #3758318.
Alert on authentication anomalies for accounts with access to ADS functionality, including impossible-travel logins and off-hours activity.

How to Mitigate CVE-2026-58235

Immediate Actions Required

Apply the SAP-provided fix from SAP Note #3758318 on all affected SAP NetWeaver Application Server Java systems running the Adobe Document Service.
Restrict access to ADS endpoints to only the service accounts and application users that require document generation.
Review and reduce privileges for authenticated users who can reach ADS, following least-privilege principles.

Patch Information

SAP has published the corrective content through SAP Security Patch Day. Administrators should consult SAP Note #3758318 and the SAP Security Patch Day portal for the fixed release levels and detailed installation instructions covering the updated cryptographic and data transfer libraries in the Adobe Document Service.

Workarounds

If patching cannot be performed immediately, limit network exposure of the SAP NetWeaver AS Java instance to trusted management networks only.
Disable the Adobe Document Service on systems that do not require interactive form or PDF generation until the patch can be applied.
Enforce strong authentication and session controls on SAP NetWeaver AS Java to reduce the pool of low-privileged accounts an attacker can compromise.

bash

# Configuration example - verify ADS deployment and patch level on SAP NetWeaver AS Java
# Check deployed patch level via SAP Solution Manager or System Info page:
#   http(s)://<host>:<port>/AdobeDocumentServices/Config
# Then confirm SAP Note #3758318 is applied through Note Assistant (SNOTE)
# and validate the Adobe Document Service component version matches the fixed release.