CVE-2026-58240: 
SAP NetWeaver Application Server ABAP 취약성 분석 및 완화

CVE-2026-58240 (also tracked as GHSA-wcwm-g7vg-pg73 and internally dubbed "S4GET") is a critical authentication bypass vulnerability in the SAP NetWeaver Message Server. The flaw allows unauthenticated network attackers to register unauthorized internal application server components due to insufficient validation of component authenticity during registration. Affected versions include SAP NetWeaver (Message Server) KERNEL 9.16, 9.18, 9.19, and 9.20. Disclosed on September 8, 2026, as part of SAP's September 2026 Security Patch Day, it carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Onapsis).

The root cause is classified as CWE-308 (Use of Single-factor Authentication): the SAP NetWeaver Message Server relies on insufficient authentication mechanisms when internal application server components attempt to register with the message server, allowing any network-reachable attacker to impersonate a legitimate component without valid credentials. The attack vector is fully network-accessible, requires no privileges, no user interaction, and has low complexity — making it automatable at scale. A technical write-up on dev.to describes the vulnerability as enabling "cluster-wide RCE" by exploiting the missing authentication in the message server's component registration interface (dev.to, GitHub Advisory). A proof-of-concept was reportedly published within approximately 96 hours of patch day (SecurityBridge).

Successful exploitation allows an unauthenticated attacker to register a malicious component within the SAP NetWeaver application environment, enabling unauthorized actions across the cluster with high impact on confidentiality, integrity, and availability. An attacker could read sensitive business data, manipulate application behavior, disrupt service availability, and potentially achieve remote code execution across connected SAP systems. Given that SAP NetWeaver underpins critical ERP landscapes, exploitation could expose financial records, HR data, and supply chain information, with significant potential for lateral movement across interconnected SAP components (Onapsis, BleepingComputer).

As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made (Feedly). However, SecurityBridge reported that a public proof-of-concept was developed within 96 hours of patch release, significantly lowering the barrier to exploitation (SecurityBridge). The EPSS score is approximately 0.343%, placing it in the 28th percentile for near-term exploitation probability (GitHub Advisory). The vulnerability is marked as automatable by NVD SSVC analysis, and security researchers have noted that over 10,000 internet-facing SAP systems could be at risk (UnderCodeNews). The CVE is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Use tools such as Shodan or Censys to identify internet-facing SAP NetWeaver Message Server instances running KERNEL versions 9.16, 9.18, 9.19, or 9.20. The Message Server typically listens on TCP port 3600 (internal) or 3900 (HTTP).
2. Identify the Message Server endpoint: Confirm the target's Message Server port and reachability. The internal registration port (default 3600) is the primary attack surface.
3. Craft a malicious registration request: Construct a network request that mimics a legitimate SAP application server component registration, exploiting the lack of strong authentication validation. No credentials are required.
4. Register unauthorized component: Submit the crafted registration packet to the Message Server. Due to CWE-308 (single-factor/no authentication), the server accepts the rogue component as a trusted internal node.
5. Perform unauthorized actions: Once registered as a trusted component, the attacker can intercept or manipulate traffic between application servers and the message server, inject malicious data, or leverage cluster-wide trust to achieve remote code execution on connected application servers (dev.to, Onapsis).

• Network: Unexpected or unrecognized application server component registration requests to the SAP Message Server on TCP port 3600 or 3900 from external or unauthorized IP addresses; unusual outbound connections from the Message Server host to unknown endpoints.
• Logs: SAP system logs (SM21, SMGW) showing registration of unknown or unexpected application server instances; Message Server trace logs (ms_*.trc) recording component registrations from unfamiliar hostnames or IP addresses.
• Process/Application: Unexpected entries in the SAP system landscape (transaction SMMS or Message Server monitor) listing unrecognized application server nodes; anomalous load balancing behavior or traffic redirection through unregistered components.
• File System: Unexpected new files or scripts on the Message Server host, particularly in SAP work directories, potentially indicating post-exploitation activity following cluster compromise (Onapsis, dev.to).

SAP released patches for CVE-2026-58240 as part of the September 2026 Security Patch Day; the relevant SAP Security Note is 3759472, available via the SAP Support Portal (GitHub Advisory). Organizations should apply the patch immediately across all affected KERNEL versions (9.16, 9.18, 9.19, 9.20). As a network-level workaround, restrict access to the SAP Message Server's internal registration port (default TCP 3600) using firewalls or network ACLs so that only authorized application server IP addresses can connect. Additionally, monitor the Message Server for unauthorized component registration events using SAP transaction SMMS and enable alerting on anomalous registrations (Onapsis, SecurityBridge).

The vulnerability received significant coverage from the SAP security community. Onapsis published a dedicated threat advisory naming the vulnerability "S4GET" and highlighted its potential for cluster-wide RCE (Onapsis). BleepingComputer and SecurityWeek covered the September 2026 SAP Patch Day, noting the critical severity of this and related flaws (BleepingComputer, SecurityWeek). The Hacker News and Infosecurity Magazine also reported on the patch day, emphasizing the risk to enterprise ERP systems (The Hacker News, Infosecurity Magazine). CERT-EU issued a security advisory covering the September 2026 SAP vulnerabilities (CERT-EU). SecurityBridge noted the rapid development of a PoC within 96 hours of patch release, urging immediate remediation (SecurityBridge).