Loading vulnerability…
Information Disclosure in SAP NetWeaver Application Server for ABAP and ABAP Platform Diagnostic Trace
CVE-2026-58246 is an information disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform. When diagnostic tracing is activated by a privileged user, the affected software writes sensitive session identifier information into trace output. An attacker who can access the generated trace data can recover valid session identifiers and use them to impersonate legitimate users for the lifetime of those sessions. The issue affects confidentiality by exposing authentication-related session material through diagnostic logging.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows disclosure of sensitive session identifiers from diagnostic trace data. An attacker who obtains those identifiers can impersonate legitimate users while the identifiers remain valid, resulting in high confidentiality impact. Based on the available information, integrity and availability are not impacted.
If you can’t patch tonight, do this now.
Until remediation is applied, restrict access to diagnostic trace data to the smallest possible set of trusted administrators, avoid enabling the affected tracing functionality except when strictly necessary, and minimize retention, distribution, and exposure of generated trace files. Operational controls around trace collection and storage should be reviewed to prevent unauthorized access to session-related diagnostic output.
Patch, then assume compromise.
Apply the vendor-provided security fix from SAP for SAP NetWeaver Application Server for ABAP and ABAP Platform, or upgrade to a remediated version identified by the relevant SAP Security Note when available in the affected environment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.