# CVE-2026-58246: SAP NetWeaver AS ABAP sensitive information exposure in diagnostic trace

Source: https://junglewise.ai/threats/cve-2026-58246-sap-netweaver-as-abap-sensitive-information-exposure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-58246 · Severity: medium · CVSS 4.3 · Published 2026-07-28

SAP NetWeaver Application Server for ABAP, a core component for running SAP business applications, contains a vulnerability where sensitive session identifiers are recorded in diagnostic logs. If a privileged user activates diagnostic tracing, these identifiers are exposed, potentially allowing an attacker with access to those logs to impersonate legitimate users. This could lead to unauthorized access to business data, though it does not directly allow the attacker to modify data or disrupt system availability.

Vendors: [SAP SE](https://junglewise.ai/threats/vendors/sap-se).

## Quick answers

**Is CVE-2026-58246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58246 being exploited in the wild.

**How severe is CVE-2026-58246?** Medium severity, with a CVSS score of 4.3, published 28 July 2026.

**Which products and versions are affected?** SAP SE ABAP Platform SAP_BASIS 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795.

**Is there a fix for CVE-2026-58246?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58246 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-58246?** Check whether you run SAP SE ABAP Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as an exposure of sensitive information (CWE-497) within the diagnostic tracing component of SAP NetWeaver AS ABAP. When a privileged user enables diagnostic tracing, the system inadvertently records active session identifiers into the trace files. An attacker who gains access to these trace logs—requiring high privileges and adjacent network access—can extract these identifiers to hijack active user sessions. The exploitability is limited by the validity period of the session identifiers and requires the trace to be actively running. SAP has released security notes (3413033) to address this behavior.

## Affected products

- SAP SE NetWeaver Application Server for ABAP and ABAP Platform SAP_BASIS 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 795

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory

## References

- [https://me.sap.com/notes/3413033](https://me.sap.com/notes/3413033)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP Application Server ABAP code injection in NetWeaver and ABAP Platform](https://junglewise.ai/threats/cve-2026-40129-sap-application-server-abap-code-injection-in-netweaver-and-abap)