CVE-2026-58241 Overview
CVE-2026-58241 is a missing authorization vulnerability [CWE-862] in the SAP NetWeaver and ABAP Platform Change and Transport System, specifically within the Customer Transport Integration Wizard. A low-privileged authenticated user can modify configuration tables that govern access to data objects during specific operations. The unauthorized modifications can cause processing delays and operational disruption. The flaw affects the integrity and availability of the application but does not expose confidential data.
Critical Impact
An authenticated low-privileged attacker with network access can tamper with transport configuration tables, disrupting change management workflows and degrading application availability across affected SAP landscapes.
Affected Products
- SAP NetWeaver (Change and Transport System)
- SAP ABAP Platform (Change and Transport System)
- Customer Transport Integration Wizard component
Discovery Timeline
- 2026-08-11 - CVE-2026-58241 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-58241
Vulnerability Analysis
The vulnerability resides in the Customer Transport Integration Wizard component of the SAP Change and Transport System (CTS). CTS coordinates development-to-production movement of ABAP objects and customizing across SAP landscapes. The wizard fails to enforce authorization checks when users interact with configuration tables that control access to data objects during transport operations.
An authenticated user with low privileges can modify these configuration tables. Downstream operations that consult those tables may then behave unexpectedly, stall, or fail entirely. The result is degraded transport processing and reduced availability for legitimate change management activities.
The attack vector is Network with High attack complexity. Confidentiality is not impacted, while integrity and availability each sustain limited impact. No user interaction is required.
Root Cause
The root cause is a missing authorization check [CWE-862]. The Customer Transport Integration Wizard does not verify that the acting user has the required role or authorization object before permitting write operations on configuration tables tied to transport data-object access controls. This omission allows privilege boundaries within CTS to be bypassed for specific table maintenance actions.
Attack Vector
Exploitation requires an authenticated session on the SAP system and network reachability to the affected component. The attacker invokes the wizard functionality and issues configuration changes that would normally require elevated CTS administration authorizations. Because the authorization check is absent, the write completes. Attack complexity is High, reflecting conditions or timing that must align for the manipulation to produce operational impact.
No public exploit code is available for CVE-2026-58241, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is described in prose only; refer to SAP Note #3752864 for vendor technical detail.
Detection Methods for CVE-2026-58241
Indicators of Compromise
- Unexpected modifications to CTS configuration tables governing data-object access during transports.
- Transport requests exhibiting unexplained processing delays or failed release stages.
- Change documents (CDHDR/CDPOS) showing table updates performed by low-privileged users who lack CTS administration roles.
- Wizard invocations from user accounts outside the transport administrator population.
Detection Strategies
- Enable and review SAP Security Audit Log (SM19/SM20) events for table maintenance and wizard execution by non-administrator users.
- Baseline normal CTS configuration state and alert on drift in tables referenced by the Customer Transport Integration Wizard.
- Correlate transport error logs with recent configuration table changes to identify tampering-driven disruption.
Monitoring Recommendations
- Forward SAP audit logs and change document records to a centralized analytics platform for behavioral review.
- Monitor RFC and dialog activity targeting CTS transactions from accounts without transport administration authorizations.
- Track service-level indicators for transport processing latency to detect availability impact early.
How to Mitigate CVE-2026-58241
Immediate Actions Required
- Apply the patch referenced in SAP Note #3752864 on all affected NetWeaver and ABAP Platform systems.
- Review authorization assignments for the Customer Transport Integration Wizard and restrict access to designated transport administrators.
- Audit recent changes to CTS configuration tables and roll back unauthorized modifications.
Patch Information
SAP addressed CVE-2026-58241 through SAP Note #3752864, published on SAP Security Patch Day. Administrators should download and apply the note via standard SAP support channels. See the SAP Security Patch Day page for the full advisory bundle and applicability guidance.
Workarounds
- Restrict execution rights on the Customer Transport Integration Wizard to accounts holding CTS administrator authorizations.
- Tighten authorization objects controlling maintenance of the impacted configuration tables until the patch is applied.
- Increase audit logging granularity for transport-related transactions to shorten detection time for abuse attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
