CVE-2026-58246 Overview
CVE-2026-58246 affects SAP NetWeaver Application Server for ABAP and ABAP Platform. The application writes sensitive session identifier information into a diagnostic trace when a privileged user activates tracing. An attacker with access to the resulting trace data can obtain identifiers that allow impersonation of legitimate users during their validity period.
The issue maps to [CWE-497] Exposure of Sensitive System Information to an Unauthorized Control Sphere. Confidentiality impact is high, while integrity and availability are not affected. The Exploit Prediction Scoring System (EPSS) probability is 0.15%.
Critical Impact
Exposed session identifiers in diagnostic traces enable user impersonation for the duration of session validity, resulting in unauthorized access to ABAP application data.
Affected Products
- SAP NetWeaver Application Server for ABAP
- SAP ABAP Platform
- Systems with diagnostic tracing enabled by privileged users
Discovery Timeline
- 2026-07-28 - CVE-2026-58246 published to the National Vulnerability Database (NVD)
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-58246
Vulnerability Analysis
The vulnerability resides in the diagnostic trace subsystem of SAP NetWeaver Application Server for ABAP. When a privileged user activates a diagnostic trace, the trace routines record session identifier data alongside other runtime information. Session identifiers should be treated as authentication material and excluded from any persistent diagnostic output.
An actor who reads the resulting trace files can replay the captured identifiers against the SAP application server. Successful replay grants the actor the privileges of the impersonated user until the session expires. The flaw does not permit modification of application data or disruption of service on its own.
Exploitation requires an adjacent network position, high privileges to activate tracing, and user interaction. See SAP Note #3413033 and SAP Security Patch Day for vendor guidance.
Root Cause
The root cause is improper handling of sensitive information within debug output paths, classified as [CWE-497]. Diagnostic tracing captures the full session context without redacting authentication tokens or session identifiers before writing to trace storage.
Attack Vector
The attack requires an adjacent network vector and depends on a privileged user first enabling diagnostic tracing. After the trace is generated, an attacker with read access to the trace repository extracts session identifiers. The attacker then submits the identifiers to the SAP application server to impersonate the legitimate session owner.
No verified exploitation code is available in public repositories, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-58246
Indicators of Compromise
- Presence of session identifier strings or authentication cookies inside ABAP diagnostic trace files or developer traces
- Access to trace storage paths by accounts that do not perform routine SAP Basis administration
- Concurrent active sessions for a single SAP user originating from distinct network sources
Detection Strategies
- Audit SAP transactions SM50, SM21, and ST12 for activation of diagnostic traces by privileged accounts
- Search trace file contents for patterns consistent with session cookies, MYSAPSSO2 tokens, or ABAP session context structures
- Correlate trace activation events with subsequent read access to trace directories on the application server file system
Monitoring Recommendations
- Alert on any changes to the trace level for user sessions in production ABAP systems
- Monitor file system access to SAP work directories, including /usr/sap/<SID>/<instance>/work/, for reads by non-administrative accounts
- Track authentication anomalies where an existing session identifier is reused from a new adjacent network source
How to Mitigate CVE-2026-58246
Immediate Actions Required
- Apply the SAP security note referenced in SAP Note #3413033 to affected NetWeaver AS ABAP and ABAP Platform systems
- Disable diagnostic tracing on production systems unless actively required for a support case
- Restrict access to existing trace files and rotate active user sessions after review
Patch Information
SAP released fixes as part of the monthly SAP Security Patch Day. Reference the vendor advisory at SAP Security Patch Day and apply the note-specific corrections detailed in SAP Note #3413033. Confirm the patch level using transaction SPAM or SNOTE after implementation.
Workarounds
- Limit the authorization objects that permit trace activation, including S_ADMI_FCD and developer trace privileges, to a minimal set of Basis administrators
- Store trace output on volumes with strict access control lists and enable file access auditing
- Purge existing trace files that may contain session identifiers and terminate potentially exposed sessions using transaction SM04
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
