Is CVE-2026-58236 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58236 being exploited in the wild.

How severe is CVE-2026-58236?

Medium severity, with a CVSS score of 5.5, published 11 August 2026.

Is there a fix for CVE-2026-58236?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58236 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-58236?

Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58236: SAP NetWeaver Application Server ABAP OS command execution via security control bypass

CVE-2026-58236 · Severity: medium · CVSS 5.5 · Published 2026-08-11

SAP NetWeaver Application Server ABAP and ABAP Platform are enterprise middleware systems used to run critical business applications and processes. A high-privilege attacker can bypass security controls to execute operating system commands, potentially stopping the system or corrupting data. This could cause significant business disruption and system downtime.

Technologies: SAP NetWeaver Application Server ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-58236 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58236 being exploited in the wild.
How severe is CVE-2026-58236?: Medium severity, with a CVSS score of 5.5, published 11 August 2026.
Which products and versions are affected?: SAP NetWeaver Application Server ABAP <UNKNOWN>.
Is there a fix for CVE-2026-58236?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58236 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-58236?: Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability involves a missing security control on an internal code path in SAP NetWeaver Application Server ABAP and ABAP Platform that allows OS command execution. The attack requires high-level privileges, indicating the threat actor must already have elevated access to the system. Successful exploitation enables execution of arbitrary OS-level commands, leading to high impact on availability (system shutdown) and low impact on integrity (file modification). The CVSS 5.5 (medium) score reflects the requirement for high privileges as a precondition. Patches are available via SAP Security Notes published on the regular SAP Security Patch Day schedule.

Affected products

SAP NetWeaver Application Server ABAP <UNKNOWN>
SAP ABAP Platform <UNKNOWN>

Timeline

2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.