CVE-2026-58240: SAP NetWeaver Authentication Bypass Flaw

CVE-2026-58240 Overview

CVE-2026-58240 is an improper authentication vulnerability in the SAP NetWeaver Message Server. The Message Server fails to sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service can register an unauthorized component and perform unauthorized actions inside the application environment. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected SAP system. The weakness is classified under CWE-308: Use of Single-Factor Authentication.

Critical Impact
An unauthenticated network attacker can register a rogue application server component with the SAP Message Server and gain full compromise of the affected NetWeaver system.

Affected Products

SAP NetWeaver Application Server (Message Server component)
Refer to SAP Note #3759472 for the authoritative list of affected versions
Related fixes are published on the SAP Security Patch Day Announcement page

Discovery Timeline

2026-09-08 - CVE-2026-58240 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-58240

Vulnerability Analysis

The SAP NetWeaver Message Server coordinates communication between application server instances in an SAP system. During instance startup, application server components register themselves with the Message Server so that workload can be distributed across dialog, update, and enqueue work processes. This registration handshake is the trust boundary between the central Message Server and the application servers it orchestrates.

CVE-2026-58240 exists because the Message Server does not sufficiently verify the authenticity of a registering component. An attacker who can reach the internal Message Server port over the network can present themselves as a legitimate application server instance and complete registration without valid credentials or cryptographic proof of identity. Once accepted, the rogue component participates in the SAP system as a trusted node.

This grants the attacker a position to influence routing, intercept traffic between real application servers, or issue instructions that legitimate components will honor. The result is a full break of confidentiality, integrity, and availability against the target SAP landscape.

Root Cause

The root cause is missing or insufficient authentication on the Message Server registration protocol, categorized as [CWE-308]. The registration path trusts network-reachable peers instead of enforcing strong mutual authentication of internal components.

Attack Vector

The attack is remote and unauthenticated. An attacker only needs network access to the Message Server's internal port, which is historically the port bound for application server communication rather than the port exposed to end-user clients. Environments that expose the internal Message Server port beyond the trusted server segment are directly reachable from adjacent networks.

No verified public exploit is available at the time of publication. The vulnerability mechanism is described in prose only; see SAP Note #3759472 for vendor technical details.

Detection Methods for CVE-2026-58240

Indicators of Compromise

Unexpected application server instances appearing in the Message Server registration list, visible through ms/server_list monitoring or transaction SMMS.
Registrations originating from IP addresses that do not correspond to authorized SAP application servers in the landscape.
Anomalous work process routing or unexpected logon groups being advertised by newly registered components.

Detection Strategies

Monitor the Message Server internal port (default 39<NN> where <NN> is the instance number) for inbound connections from hosts outside the SAP server subnet.
Enable and review Message Server access logging (ms/audit) to capture registration and administrative commands.
Compare the live registered server list against a known-good inventory of application server hostnames on a scheduled cadence.

Monitoring Recommendations

Alert on any registration event from a source address not on the SAP application server allowlist.
Track changes to the ms/acl_info access control file and to profile parameters that govern Message Server behavior.
Forward SAP security audit log (SM19/SM20) and Message Server logs into a central SIEM for correlation with network telemetry.

How to Mitigate CVE-2026-58240

Immediate Actions Required

Apply the SAP-provided fix referenced in SAP Note #3759472 on all affected NetWeaver systems.
Restrict network access to the Message Server internal port so that only authorized application server hosts can reach it.
Audit the current list of registered application server components and remove any that are not part of the authorized landscape.

Patch Information

SAP released the corrective note as part of SAP Security Patch Day. Administrators should consult SAP Note #3759472 for the exact support package levels and kernel patches required, and cross-reference the monthly SAP Security Patch Day Announcement for related advisories.

Workarounds

Enforce separation between the Message Server internal port and the external port used by clients, and firewall the internal port to the SAP server segment only.
Configure ms/acl_info with an explicit allowlist of application server IP addresses permitted to register.
Set the profile parameter ms/monitor = 0 and ms/admin_port restrictions to limit administrative access to the Message Server.
Where possible, enable SNC (Secure Network Communications) between application server components to add cryptographic authentication on top of network controls.

bash

# Example ms/acl_info allowlist entries (illustrative)
# Restrict which hosts may register with the Message Server
HOST=app01.corp.example
HOST=app02.corp.example
HOST=app03.corp.example
# Deny all other sources by default