Critical SAP NetWeaver Message Server Flaw Enables Pre-Auth RCE
Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Sep 8, 2026
SAP disclosed CVE-2026-58240 (also tracked as S4GET), a critical missing-authentication and trust-validation flaw in SAP NetWeaver Message Server, rated CVSS 9.8. An unauthenticated attacker able to reach the Message Server’s public SAP GUI-facing port can send a crafted packet, cause an IP address to be trusted across an SAP cluster, and bypass Gateway trust boundaries. The resulting rogue component registration or trusted-peer impersonation can enable interception, alteration, redirection, or disruption of SAP inter-component traffic and may lead to remote code execution as the SAP operating-system account <sid>adm.
Affected deployments include SAP NetWeaver Message Server components on kernel versions 9.16, 9.18, 9.19, and 9.20. SAP issued the definitive remediation in Security Note 3759472; organizations should apply it immediately, identify and restrict Message Server public-port exposure—especially Internet exposure—and review cluster and Gateway trust configurations. No confirmed in-the-wild exploitation or CISA KEV listing had been reported at publication, but the public network attack surface and likelihood of rapid weaponization make this a high-priority patching issue.
