CVE-2026-58243 Overview
CVE-2026-58243 is a missing authorization vulnerability [CWE-862] in SAP ABAP Development Tools affecting SAP NetWeaver AS ABAP. The flaw stems from absent authorization checks in specific functionality, allowing an authenticated attacker with low privileges to invoke unauthorized database operations. Successful exploitation permits reading sensitive data, modifying application data, and disrupting access for legitimate users. The vulnerability is exploitable over the network without user interaction.
Critical Impact
An authenticated low-privileged attacker can execute unauthorized database operations against SAP NetWeaver AS ABAP, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- SAP ABAP Development Tools
- SAP NetWeaver Application Server ABAP
- Refer to SAP Note #3772411 for exact component versions
Discovery Timeline
- 2026-08-11 - CVE-2026-58243 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-58243
Vulnerability Analysis
The vulnerability resides in SAP ABAP Development Tools, the Eclipse-based tooling that interacts with SAP NetWeaver AS ABAP backend services. Certain functionality exposed by the tooling does not enforce required authorization checks before dispatching database operations. An attacker with a valid low-privilege account can craft requests that reach these code paths and issue operations they would otherwise be denied. The result is unauthorized read and write access to backend database artifacts and disruption of legitimate access.
Root Cause
The root cause is missing authorization enforcement [CWE-862]. Server-side handlers accept requests from authenticated principals without verifying that the caller holds the SAP authorization objects required to perform the requested database operation. Authorization is either omitted or applied inconsistently across the affected code paths.
Attack Vector
The attack vector is network-based and requires low privileges but no user interaction. An authenticated attacker directs crafted requests through the ABAP Development Tools protocol surface to the AS ABAP instance. Because authorization checks are absent, the request reaches database-facing routines and executes read or write operations outside the caller's intended role. See the vendor advisory for technical details: SAP Note #3772411.
Detection Methods for CVE-2026-58243
Indicators of Compromise
- Requests from ABAP Development Tools clients originating from users or workstations that do not normally perform development activity
- Unexpected database read or modification events attributed to low-privileged accounts in SAP audit logs
- Anomalous access to sensitive tables or ABAP repository objects outside business hours
Detection Strategies
- Enable and centralize the SAP Security Audit Log (SM19/SM20) and forward events to a SIEM for correlation
- Alert on database operations executed by accounts lacking corresponding authorization object assignments
- Baseline normal ABAP Development Tools traffic per user and flag deviations in volume or targeted objects
Monitoring Recommendations
- Monitor ABAP RFC and HTTP endpoints used by ABAP Development Tools for spikes in error and success rates
- Track privileged table access (for example, USR02, T000, and custom sensitive tables) and correlate with source user roles
- Review changes to ABAP objects and transport requests initiated by non-developer accounts
How to Mitigate CVE-2026-58243
Immediate Actions Required
- Apply the SAP patch referenced in SAP Note #3772411 to all affected AS ABAP systems
- Review and tighten role assignments so that non-developer accounts do not hold ABAP Development Tools authorizations
- Audit recent SAP Security Audit Log entries for unauthorized database activity by low-privileged users
Patch Information
SAP released a fix as part of SAP Security Patch Day. Administrators must implement SAP Note #3772411 and consult SAP Security Patch Day for the corresponding support package or kernel patch level applicable to their release train.
Workarounds
- Restrict network access to AS ABAP development endpoints to trusted developer workstations and jump hosts
- Remove ABAP Development Tools authorizations from accounts that do not require them until patching is complete
- Enforce stronger authentication (SNC or MFA where supported) for accounts able to reach the affected functionality
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
