Description
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Availability disruption
Action: Patch
AI Analysis

Impact

The vulnerability is a memory‑corruption flaw in SAP NetWeaver and SAP Web Dispatcher caused by inadequate validation of fields in specially crafted requests processed by an internal protocol component. An unauthenticated attacker can send a malicious request that triggers a memory‑handling error, leading the affected process to crash. Because the crash terminates the service, the primary impact is loss of availability; the vulnerability does not affect confidentiality or integrity.

Affected Systems

The flaw affects SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) deployed by SAP SE. No specific version range is listed in the advisory, so all installations of these components that are not patched are considered vulnerable.

Risk and Exploitability

The CVSS v3 score is 7.5, indicating a high impact on availability. The EPSS score is not available, so the current likelihood of exploitation is uncertain. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote unauthenticated over the network by sending a crafted request to the internal protocol; an attacker could repeatedly provoke crashes to deny service to legitimate users.

Generated by OpenCVE AI on October 13, 2026 at 02:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply SAP Security Note 3765424 to address the memory‑handling error.
  • Restart SAP NetWeaver and SAP Web Dispatcher services after patching to clear affected memory areas.
  • Restrict inbound traffic to the internal protocol of SAP Web Dispatcher to trusted IPs using firewall or reverse‑proxy rules.

Generated by OpenCVE AI on October 13, 2026 at 02:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Sap Se
Sap Se sap Netweaver And Sap Web Dispatcher (internet Communication Manager)
Vendors & Products Sap Se
Sap Se sap Netweaver And Sap Web Dispatcher (internet Communication Manager)

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Title Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Sap Se Sap Netweaver And Sap Web Dispatcher (internet Communication Manager)
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-13T13:28:31.569Z

Reserved: 2026-06-29T19:35:04.186Z

Link: CVE-2026-58249

cve-icon Vulnrichment

Updated: 2026-10-13T13:20:12.636Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T01:16:46.213

Modified: 2026-10-15T20:38:04.303

Link: CVE-2026-58249

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:24:09Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)