VulnSocial

CVE-2026-58240Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-308

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 12 mentions across 5 observed days
  • Momentum state: declining

What's happening

  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 8 signals
  • Disclosure: 5 classified signals
  • General: 2 classified signals
  • Peaked 4d ago at 7 mentions (2026-09-08); latest day: 1
  • 12 total mentions across 5 days

Deep dive

Activity timeline12 mentions / 5d
02457Mentions · 2026-09-08: 7Mentions · 2026-09-09: 2Mentions · 2026-09-10: 1Mentions · 2026-09-11: 1Mentions · 2026-09-21: 1PoC Mentioned / Linked · 2026-09-08: 2Patch / Workaround · 2026-09-08: 3Patch / Workaround · 2026-09-09: 2Patch / Workaround · 2026-09-10: 1Patch / Workaround · 2026-09-11: 1Technical Details · 2026-09-08: 5Technical Details · 2026-09-09: 2Technical Details · 2026-09-10: 109-0809-0909-1009-1109-21
Signal classification3 categories
Disclosure
541.7%
Patch
541.7%
General
216.7%
Referenced assets10 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-087
Disclosure4General1Patch2
2026-09-092
Disclosure1Patch1
2026-09-101
Patch1
2026-09-111
Patch1
2026-09-211
General1
Full discourse12 posts
  • Martin Gallo 🇦🇷 💚✊🏾🚀@MartinGalloAr
    General

    Released @OWASP CBAS' pysap v0.2.1! EPP (Extended Passport) support, Message Server monitoring and packet handling, improved SAP Router fingerprinting, ++ Packets for both CVE-2026-58240 and CVE-2026-44756 now supported also! https://github.com/OWASP/pysap/releases/tag/v0.2.1 and on PyPi 😊

    Post summary

    The text announces the release of pysap v0.2.1, which adds support for packets related to CVE-2026-58240 and CVE-2026-44756, but does not provide PoC, exploit, patch, or active exploitation details.

    00041218
    1.2K followersView on X
  • Directoratul Național de Securitate Cibernetică@DNSC_RO
    Patch

    🚨 ALERTĂ - Vulnerabilități critice identificate la nivelul unor produse SAP 🔐 Printre vulnerabilitățile remediate se numără CVE-2026-44756, CVE-2026-58240, CVE-2026-76969 și CVE-2026-66768, toate clasificate drept vulnerabilități critice. 👉 https://www.dnsc.ro/citeste/alerta-vulnerabilitati-critice-identificate-la-nivelul-unor-produse-sap #DNSC https://t.co/xmAg4FRMpy

    Post summary

    The alert announces that four newly identified SAP product vulnerabilities (CVE-2026-44756, 2026-58240, 2026-76969, 2026-66768) have been remediated and classified as critical.

    01020219
    4.7K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    [CVE] CVE-2026-58240 [HIGH PRIORITY] #Missing Authentication check in SAP NetWeaver (Message Server) 🔗 https://exploitgrid.net/cve/CVE-2026-58240

    Post summary

    The post discloses a high‑priority CVE-2026-58240, describing a missing authentication check in SAP NetWeaver’s Message Server, and provides a link to exploitgrid for further details.

    1000044
    41 followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-44756 CVE-2026-75650 CVE-2026-86296 CVE-2026-18922 CVE-2026-58240 ..🧵👇

    Post summary

    The post lists several CVE identifiers without providing any details on exploitation, patches, or technical characteristics.

    10000110
    41 followersView on X
  • JjungSSCG@JjungSscg
    Patch

    #SAP hat die kritische Schwachstelle #S4GET (CVE-2026-58240) im #NetWeaver Message Server gepatcht - #CVSS 9,8, keine Anmeldedaten nötig für vollständige Codeausführung. #Onapsis https://security-storage-und-channel-germany.de/sap-schliesst-kritische-netweaver-sicherheitsluecke-s4get/

    Post summary

    SAP has released a patch for CVE-2026-58240, a critical NetWeaver Message Server vulnerability with a CVSS score of 9.8 that allows remote code execution without authentication.

    0000066
    33 followersView on X
  • ActuX@ActuX_off
    Disclosure

    🚨 CYBER — Alerte majeure pour les entreprises utilisant SAP : deux failles critiques permettent potentiellement de prendre le contrôle d’un serveur à distance, sans identifiant. La plus sévère, CVE-2026-44756 « OVERPASS », affiche le score maximal CVSS 10/10. Elle touche le kernel SAP et peut permettre l’exécution de commandes arbitraires avec les privilèges du système SAP. Une seconde faille, CVE-2026-58240, atteint un score de 9,8/10 et permet également une compromission à distance sans authentification. De nombreux environnements professionnels peuvent être concernés : SAP S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, BW/4HANA ou encore Enterprise Portal. ⚠️ Une exploitation réussie pourrait permettre le vol ou la modification de données métiers, l'installation d'une porte dérobée ou préparer le déploiement d’un ransomware. SAP a publié les correctifs et le CERT-EU appelle à les appliquer rapidement. Aucune exploitation active n’est toutefois confirmée à ce stade. 💬 Avec SAP au cœur des processus financiers, industriels et logistiques de milliers d’entreprises, combien de temps faudra-t-il pour sécuriser l’ensemble du parc exposé ? Source : SAP / CERT-EU / Onapsis #Cybersecurite #SAP #S4HANA #NetWeaver #OVERPASS #CVE #Cyberattaque

    Post summary

    SAP has disclosed two critical kernel vulnerabilities (CVE‑2026‑44756 and CVE‑2026‑58240) with high CVSS scores, notes potential for remote control and data tampering, and urges applying published patches, with no active exploitation confirmed at this time.

    0000080
    230 followersView on X
  • The CyberSec Guru@thecybersecguru
    Patch

    🚨 SAP just patched a CVSS 10.0 nightmare. CVE-2026-44756 “OVERPASS” is a pre-auth SAP Kernel flaw that can let an unauthenticated attacker go from a crafted SAP Passport header → stack overflow → instruction-pointer hijacking → remote code execution. And there’s more: CVE-2026-58240 “S4GET” (CVSS 9.8) hits the NetWeaver Message Server. No credentials. No SAP roles. No SoD protection. Full breakdown + attack paths + patching guidance 👇 https://thecybersecguru.com/news/sap-overpass-cve-2026-44756/ #SAP #CyberSecurity #CVE #RCE #SAPSecurity #S4HANA #InfoSec

    Post summary

    SAP has released patches for two critical CVEs (CVE-2026-44756 and CVE-2026-58240) that enable unauthenticated remote code execution; detailed technical information and patching guidance are available via the provided link.

    00000152
    1.6K followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    🔓 SAP NetWeaver Message Server — CVSS 9.8. CVE-2026-58240 lets unauthenticated attackers register rogue app server components over the network. Zero auth, zero interaction. Patch via SAP Note 3759472. #cybersecurity #ciso #SAP #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-58240?utm_campaign=x https://t.co/IU8zXLONja

    Post summary

    SAP NetWeaver Message Server CVE‑2026‑58240 is a high‑severity, unauthenticated vulnerability that allows attackers to register rogue app server components, and it can be mitigated by applying SAP Note 3759472.

    00000120
    888 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: SAP Patch Day: OVERPASS CVE-2026-44756 max-severity kernel EPP overflow lets unprivileged actors get admin on SAP via ICM. Onapsis: 10k+ internet-facing. Also S4GET CVE-2026-58240 unauth Message Server RCE. Patch Sep notes now. https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/

    Post summary

    SAP announces patches for CVE‑2026‑44756 (maximum‑severity kernel EPP overflow) and CVE‑2026‑58240 (unauthenticated Message Server RCE), issuing update notes in September.

    00000133
    3.0K followersView on X
  • Severity Daily@severitydaily
    Patch

    SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric. September patch day: CVE-2026-44756 and CVE-2026-58240. No exploitation reported. https://severitydaily.com/sap-cve-2026-44756-epp-10-0-versus-cve-2026-58240-message-server-9-8-scope/

    Post summary

    SAP announces its September patch day for CVE-2026-44756 and CVE-2026-58240, noting the CVEs carry high severity scores and that no exploitation has been reported.

    0000068
    23 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🚨 SAP NetWeaver Message Server — CVSS 9.8 CRITICAL CVE-2026-58240: Unauthenticated component registration bypass → Register malicious components as trusted peers → https://threataft.com/articles/sap-netweaver-message-server-cve-2026-58240 #cybersecurity #SAP #NetWeaver #EnterpriseSecurity #CVSS9 #PatchNow #ThreatIntel

    Post summary

    The tweet announces the SAP NetWeaver Message Server CVE‑2026‑58240, detailing its critical severity and unauthenticated component registration bypass, and provides a link likely containing the PoC.

    0000064
    43 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacke… https://www.cve.org/CVERecord?id=CVE-2026-58240

    Post summary

    The snippet announces CVE-2026-58240, noting that SAP NetWeaver Message Server fails to validate internal components during registration, potentially enabling unauthenticated attacks, but it provides no further technical or remedial details.

    000001.6K
    58.1K followersView on X

Explore more

Back to dashboard