CVE-2026-58236: SAP NetWeaver ABAP Platform RCE Vulnerability

CVE-2026-58236 Overview

CVE-2026-58236 affects SAP NetWeaver Application Server ABAP and ABAP Platform. The vulnerability exists on an internal code path where missing security controls allow an authenticated attacker with high privileges to trigger operating system command execution. Successful exploitation lets the attacker run OS-level commands that write to the host or stop the SAP system. The vulnerability is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command. SAP addressed this issue in SAP Note #3745182, released as part of SAP Security Patch Day.

Critical Impact
Authenticated attackers with high privileges can execute OS commands, write files to the host, or halt the SAP system, causing service disruption.

Affected Products

SAP NetWeaver Application Server ABAP
SAP ABAP Platform
Refer to SAP Note #3745182 for the complete list of supported release versions

Discovery Timeline

2026-08-11 - CVE-2026-58236 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-58236

Vulnerability Analysis

The flaw resides on an internal ABAP code path that invokes OS-level operations without applying required security validations. An attacker who already holds high privileges within the SAP system can reach this path and pass input that reaches the underlying operating system shell. The result is arbitrary OS command execution under the identity of the SAP runtime user, typically <sid>adm on Unix or the SAP service account on Windows.

Impact is scoped to integrity and availability. The attacker can write files on the host or terminate the SAP system, but confidentiality is not directly affected according to the advisory. Because the SAP work processes execute the resulting commands, the attacker inherits full filesystem and process control available to the SAP runtime account.

The EPSS score is 0.376% with a percentile of 30.6, indicating limited near-term exploitation likelihood at publication.

Root Cause

The root cause is missing security controls on an internal code path that constructs and executes operating system commands. Under CWE-78, input reaching this path is not neutralized before being handed to the OS command interpreter. High-privilege users who invoke the affected functionality can bypass expected authorization or validation checks and inject command elements.

Attack Vector

Exploitation requires network access to the SAP NetWeaver Application Server and an authenticated session with high privileges. No user interaction is required. The attacker reaches the vulnerable ABAP function through a legitimate interface and supplies crafted parameters that the internal path forwards to the OS command layer. Refer to SAP Note #3745182 for the specific components and interfaces involved.

No public proof-of-concept exploit or exploitation-in-the-wild reporting is associated with this CVE at publication.

Detection Methods for CVE-2026-58236

Indicators of Compromise

Unexpected child processes spawned by SAP work processes (disp+work, sapstartsrv) executing shell commands, sh, cmd.exe, or system utilities.
Files written to the SAP host by the <sid>adm or SAP service account outside standard SAP directories.
Unplanned SAP system stops or restarts logged in sapstart and dev_disp trace files without corresponding operator activity.

Detection Strategies

Enable and monitor SAP Security Audit Log (SM19/RSAU_CONFIG) for high-privilege user activity, particularly RFC and transaction calls that interact with OS command execution functionality.
Baseline expected child processes of SAP work processes and alert on deviations that indicate command spawning.
Correlate ABAP application logs with host-level process telemetry to identify OS commands originating from ABAP execution contexts.

Monitoring Recommendations

Forward SAP Security Audit Log, system log (SM21), and host process telemetry to a central analytics platform for correlation.
Alert on any use of function modules or transactions that invoke OS commands (for example SXPG_COMMAND_EXECUTE) by non-administrative or unexpected accounts.
Track privileged account activity across SAP and the underlying OS to identify lateral movement following successful exploitation.

How to Mitigate CVE-2026-58236

Immediate Actions Required

Apply the SAP patch referenced in SAP Note #3745182 on all affected NetWeaver ABAP and ABAP Platform systems.
Review and reduce assignments of high-privilege authorizations, especially S_RFC, S_LOG_COM, and profiles granting access to OS command execution.
Audit recent high-privilege user activity for evidence of the indicators listed above.

Patch Information

SAP released the fix as part of SAP Security Patch Day. Refer to SAP Note #3745182 for exact support package levels, kernel patches, and manual correction instructions. The SAP Security Patch Day portal lists the bulletin alongside other coordinated fixes.

Workarounds

Restrict access to transactions and function modules that reach the affected internal code path until patching completes.
Enforce least privilege on administrative roles and remove standing high-privilege access where not operationally required.
Isolate SAP application servers at the network layer so that only required administrative networks can reach management interfaces.

bash

# Example: review users holding high-privilege authorization for OS command execution
# Run in SAP GUI via transaction SUIM or use the following report inputs:
#   Report: RSUSR002
#   Authorization Object: S_LOG_COM
#   Field ACTVT: 16 (Execute)
# Review returned user list and remove assignments where not required.