Description
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server for ABAP | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Tue, 28 Jul 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted. | |
| Title | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | |
| First Time appeared |
Sap Se
Sap Se sap Netweaver Application Server For Abap |
|
| Weaknesses | CWE-497 | |
| CPEs | cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_740:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_750:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_751:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_752:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_753:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_754:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_755:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_756:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_757:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_758:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_795:*:abap:*:*:*:*:* |
|
| Vendors & Products |
Sap Se
Sap Se sap Netweaver Application Server For Abap |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: sap
Published:
Updated: 2026-07-28T19:16:55.291Z
Reserved: 2026-06-29T19:35:04.186Z
Link: CVE-2026-58246
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere