CVE-2026-58236: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2026-58236 is an OS command injection vulnerability (CWE-78) in SAP NetWeaver Application Server ABAP and ABAP Platform that allows a high-privileged attacker to bypass missing security controls on an internal code path, leading to operating system command execution. It was published on August 11, 2026, and affects multiple kernel versions including KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.93, and 9.16. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium/Moderate), reflecting the high privilege requirement that limits its attack surface (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where SAP NetWeaver AS ABAP fails to properly sanitize input on an internal code path, allowing injected OS commands to be passed to the underlying operating system. The attack vector is network-based with low complexity, but requires high privileges — meaning an authenticated administrator-level account is needed to reach the vulnerable code path. The vulnerability bypasses missing security controls rather than exploiting a traditional injection point exposed to lower-privileged users, making it an internal privilege escalation of OS-level capabilities. No public proof-of-concept code or detailed technical write-up has been identified at this time (GitHub Advisory, SAP Security Note).

Successful exploitation results in no confidentiality impact, low integrity impact, and high availability impact — an attacker can execute OS-level commands that write to the operating system or halt the SAP system entirely, causing significant service disruption. The ability to stop the SAP system poses a serious business continuity risk for organizations relying on SAP for critical enterprise operations. While lateral movement potential is limited by the high privilege prerequisite, an attacker who already holds administrative access could use this vulnerability to cause persistent system modifications or denial of service at the OS level (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time (Feedly Intelligence). The EPSS score is approximately 0.376% (31st percentile), indicating a low near-term probability of exploitation. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high (administrative) privileges, significantly reducing the pool of potential attackers.

SAP has addressed this vulnerability through SAP Security Note 3745182, available via the SAP Support Portal. Organizations should apply the relevant kernel patches for their affected versions (KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16) as part of the August 2026 SAP Security Patch Day. As interim mitigations, restrict high-privilege access to SAP NetWeaver AS ABAP systems to only trusted administrators, enforce least-privilege principles, and monitor system audit logs for suspicious OS command execution activity (SAP Security Note, SAP Patch Day).

The August 2026 SAP Security Patch Day, which includes CVE-2026-58236, received coverage from SAP security specialists. RedRays, Onapsis, and SecurityBridge each published patch day summaries covering the August 2026 SAP advisories (RedRays Blog, Onapsis Blog, SecurityBridge Blog). CyberSecurityNews and Cryptika also reported on the broader set of SAP vulnerabilities disclosed in August 2026, noting the potential for malicious code injection and system disruption (CyberSecurityNews, Cryptika).