Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-58236 EUVD-2026-55868GHSA-9gvf-fp5r-4gqr

OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

Published Aug 11, 2026 · Updated Aug 11, 2026 · Assigned by sap

Description

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

Affected products

VendorProductAffectedFixed
SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16 —

Advisories 1

References