{"api_version":"1","generated_at":"2026-08-11T14:12:14+00:00","cve":"CVE-2026-58243","urls":{"html":"https://cve.report/CVE-2026-58243","api":"https://cve.report/api/cve/CVE-2026-58243.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-58243","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-58243"},"summary":{"title":"Privilege Escalation vulnerability in SAP ABAP Developer Tools","description":"SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.","state":"PUBLISHED","assigner":"sap","published_at":"2026-08-11 01:17:22","updated_at":"2026-08-11 01:17:22"},"problem_types":["CWE-862","CWE-862 CWE-862: Missing Authorization"],"metrics":[{"version":"3.1","source":"cna@sap.com","type":"Primary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://url.sap/sapsecuritypatchday","name":"https://url.sap/sapsecuritypatchday","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://me.sap.com/notes/3772411","name":"https://me.sap.com/notes/3772411","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58243","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58243","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 750","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 751","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 752","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 753","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 754","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 755","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 756","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 757","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 758","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 816","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 918","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP ABAP Developer Tools","version":"affected SAP_BASIS 920","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP ABAP Developer Tools","vendor":"SAP_SE","versions":[{"status":"affected","version":"SAP_BASIS 750"},{"status":"affected","version":"SAP_BASIS 751"},{"status":"affected","version":"SAP_BASIS 752"},{"status":"affected","version":"SAP_BASIS 753"},{"status":"affected","version":"SAP_BASIS 754"},{"status":"affected","version":"SAP_BASIS 755"},{"status":"affected","version":"SAP_BASIS 756"},{"status":"affected","version":"SAP_BASIS 757"},{"status":"affected","version":"SAP_BASIS 758"},{"status":"affected","version":"SAP_BASIS 816"},{"status":"affected","version":"SAP_BASIS 918"},{"status":"affected","version":"SAP_BASIS 920"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.</p>"}],"value":"SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"eng","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-11T00:16:07.468Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"url":"https://me.sap.com/notes/3772411"},{"url":"https://url.sap/sapsecuritypatchday"}],"source":{"discovery":"UNKNOWN"},"title":"Privilege Escalation vulnerability in SAP ABAP Developer Tools","x_generator":{"engine":"Vulnogram 1.0.4"}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2026-58243","datePublished":"2026-08-11T00:16:07.468Z","dateReserved":"2026-06-29T19:35:04.185Z","dateUpdated":"2026-08-11T00:16:07.468Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-11 01:17:22","lastModifiedDate":"2026-08-11 01:17:22","problem_types":["CWE-862","CWE-862 CWE-862: Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"58243","Ordinal":"1","Title":"Privilege Escalation vulnerability in SAP ABAP Developer Tools","CVE":"CVE-2026-58243","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"58243","Ordinal":"1","NoteData":"SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.","Type":"Description","Title":"Privilege Escalation vulnerability in SAP ABAP Developer Tools"}]}}}