CVE-2026-58249: sap_se sap netweaver and sap web dispatcher (internet communication manager) Integer Underflow (Wrap or Wraparound)

Vulnerability summary

CVE-2026-58249 is a high (CVSS 7.5) Integer Underflow (Wrap or Wraparound) vulnerability in sap_se sap netweaver and sap web dispatcher (internet communication manager). EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.8% of scored vulnerabilities.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

• CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.