Loading story…
SAP disclosed CVE-2026-58240 (also tracked as S4GET), a critical missing-authentication and trust-validation flaw in SAP NetWeaver Message Server, rated CVSS 9.8. An unauthenticated attacker able to reach the Message Server’s public SAP GUI-facing port can send a crafted packet, cause an IP address to be trusted across an SAP cluster, and bypass Gateway trust boundaries. The resulting rogue component registration or trusted-peer impersonation can enable interception, alteration, redirection, or disruption of SAP inter-component traffic and may lead to remote code execution as the SAP operating-system account <sid>adm.
Affected deployments include SAP NetWeaver Message Server components on kernel versions 9.16, 9.18, 9.19, and 9.20. SAP issued the definitive remediation in Security Note 3759472; organizations should apply it immediately, identify and restrict Message Server public-port exposure—especially Internet exposure—and review cluster and Gateway trust configurations. No confirmed in-the-wild exploitation or CISA KEV listing had been reported at publication, but the public network attack surface and likelihood of rapid weaponization make this a high-priority patching issue.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SAP released the definitive fix for the critical CVSS 9.8 SAP NetWeaver Message Server flaw as Security Note 3759472 during its September 2026 Security Patch Day. The issue permits an unauthenticated attacker to abuse Message Server trust registration and potentially obtain code execution as the SAP operating-system account.
Tenable Nessus provides the sap_netweaver_kernel_3759472.nasl plugin to detect SAP NetWeaver Application Server installations affected by CVE-2026-58240. Detection requires an installed-software inventory item and the ParanoidReport setting.
Onapsis Research Labs reported the pre-authentication SAP NetWeaver Message Server vulnerability tracked as CVE-2026-58240 to SAP through a coordinated-disclosure partnership.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcethreataft.com
Open sourceonapsis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP disclosed **CVE-2026-44747**, a critical memory corruption vulnerability in **SAP NetWeaver Application Server ABAP**, and published remediation guidance in **Security Note `3747367`** as part of its Security Patch Day materials. The flaw is classified as **CWE-787** and affects multiple SAP ABAP kernel releases, including `KRNL64NUC 7.22`, `7.22EXT`, `KRNL64UC 7.22`, `7.53`, `7.54`, `7.77`, `7.89`, `7.93`, and `9.16` through `9.20`. The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a **CVSS v3.1 score of 9.1** (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was **no confirmed active exploitation** at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.
Jul 23, 2026
SAP patched **CVE-2025-31324**, a critical `CVSS 10.0` flaw in **SAP NetWeaver Visual Composer** that lets unauthenticated attackers send crafted HTTP `POST` requests to `/developmentserver/metadatauploader`, upload arbitrary files, and achieve remote code execution. Security researchers and national CSIRT reporting said the bug was actively exploited against exposed, high-value SAP systems, with attackers planting **JSP webshells** for persistent remote access and using the compromise to fully take over affected servers. SAP addressed the issue in **Security Note `3594142`** and urged customers to patch immediately or temporarily reduce exposure by disabling Visual Composer, disabling the `developmentserver` alias, and restricting access to the vulnerable endpoint. A second NetWeaver Visual Composer flaw, **CVE-2025-42999**, was later fixed in **Security Note `3604119`** after reports that attackers were chaining it with the first bug for stealthier post-compromise activity. That deserialization vulnerability requires high privileges but can also lead to arbitrary file upload and code execution, and researchers said exploitation had been observed since at least January 2025. Reporting linked the campaign to multiple threat actors, including **BianLian** and **RansomEXX**, with intrusions involving tools such as **Brute Ratel** and **Heaven's Gate** techniques to evade detection, prompting defenders to review uploaded files, inspect logs, and hunt for unauthorized webshells and follow-on payloads.
Jul 24, 2026
SAP has released security updates addressing 13 newly identified vulnerabilities across its product suite, with particular focus on a maximum-severity flaw in SAP NetWeaver AS Java. The most critical vulnerability, tracked as CVE-2025-42944 and assigned a CVSS score of 10.0, is an insecure deserialization issue that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw can be exploited via the RMI-P4 module by submitting a malicious payload to an open port, potentially compromising the confidentiality, integrity, and availability of affected systems. SAP initially addressed this vulnerability in a previous update, but the latest patch introduces additional hardening measures, including a JVM-wide filter (jdk.serialFilter) to block the deserialization of dangerous classes. The list of classes and packages to be filtered was developed in collaboration with the Onapsis Research Labs and is divided into mandatory and optional sections to maximize protection. In addition to CVE-2025-42944, SAP has patched a directory traversal vulnerability in SAP Print Service (CVE-2025-42937, CVSS 9.8), which could allow unauthenticated attackers to overwrite system files by exploiting insufficient path validation. Another critical issue, CVE-2025-42910 (CVSS 9.0), affects SAP Supplier Relationship Management and involves unrestricted file upload, enabling authenticated attackers to upload arbitrary files, including potentially malicious executables. These vulnerabilities collectively pose significant risks to enterprise environments running SAP solutions, as successful exploitation could lead to system compromise, data loss, or service disruption. SAP has stated that there is currently no evidence of these vulnerabilities being exploited in the wild. Security experts and SAP have emphasized the importance of promptly applying the latest patches to mitigate the risk of exploitation. The additional hardening for the deserialization flaw is particularly notable, as it provides a more robust defense against a class of attacks that have historically been difficult to fully remediate. Organizations are advised to review their SAP deployments, ensure all relevant updates are applied, and follow SAP’s guidance on blocking risky deserialization classes. The disclosure and remediation of these vulnerabilities highlight the ongoing challenges in securing complex enterprise software platforms. SAP’s collaboration with security researchers and the implementation of layered defenses demonstrate a proactive approach to addressing critical security issues. Enterprises relying on SAP NetWeaver and related products should prioritize these updates as part of their regular patch management processes. Failure to address these vulnerabilities could leave systems exposed to remote attacks that require no authentication, significantly increasing the risk profile for affected organizations. The security community continues to monitor for any signs of exploitation and urges vigilance in maintaining up-to-date SAP environments.
Jun 29, 2026