SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server for ABAP | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 28 Jul 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted. | |
| Title | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | |
| First Time appeared |
Sap Se
Sap Se sap Netweaver Application Server For Abap |
|
| Weaknesses | CWE-497 | |
| CPEs | cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_740:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_750:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_751:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_752:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_753:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_754:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_755:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_756:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_757:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_758:*:abap:*:*:*:*:* cpe:2.3:a:sap_se:sap_netweaver_application_server_for_abap:sap_basis_795:*:abap:*:*:*:*:* |
|
| Vendors & Products |
Sap Se
Sap Se sap Netweaver Application Server For Abap |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: sap
Published:
Updated: 2026-07-28T09:51:55.180Z
Reserved: 2026-06-29T19:35:04.186Z
Link: CVE-2026-58246
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses