CVE-2026-58236

Executive Summary

CVE-2026-58236 is an unpatched operating system command execution vulnerability (CWE-78) in SAP NetWeaver Application Server ABAP and the ABAP Platform. An attacker who already holds high-privilege access to the application can bypass missing security controls on an internal code path and execute OS-level commands, enabling actions that write to the operating system or completely stop the SAP system. The vulnerability is rated CVSS 5.5 (Medium) with high availability impact; no vendor patch, public proof-of-concept, or evidence of in-the-wild exploitation is currently available.

Technical Analysis

The NVD description characterizes CVE-2026-58236 as a flaw in which security controls are missing on an internal code path within the SAP NetWeaver Application Server ABAP and ABAP Platform runtime. The weakness is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that values reaching an OS command construction point are not neutralized for shell metacharacters, separators, or command substitutions.

Key characteristics derivable from the advisory data:

• Privilege requirement (PR:H): The attacker must already possess high-privilege application-level access — e.g., an administrative authorization profile in the ABAP stack. This is not a remote unauthenticated vulnerability.
• Network reachability (AV:N): The attack is exploitable over the network, meaning the internal code path is reachable through a network-visible interface (e.g., an HTTP/HTTPS endpoint, RFC gateway, or SAP Internet Communication Manager channel), even though the specific entry point is not disclosed.
• No user interaction (UI:N): Exploitation does not require the victim to perform any action.
• Bypass of missing security controls: The internal code path apparently lacks proper authorization or input-validation checks. Because the caller is already high-privileged, the missing control likely concerns command construction/sanitization rather than coarse-grained authorization.
• Impact profile (C:N/I:L/A:H): Confidentiality is unaffected. Integrity impact is low — the attacker can write to the operating system, e.g., create or modify files under the OS account that runs the SAP system. Availability impact is high — the attacker can stop the SAP system, causing an application denial of service to all dependent business processes.

Insufficient technical detail is available to name the precise vulnerable function, ABAP module, or HTTP endpoint. No affected version ranges have been published, no vendor advisory with a patch note is available, and the CNA title is empty. The attack mechanism must therefore be described at the vulnerability-class level: input or state data flowing through an internal, insufficiently guarded code path reaches an OS command execution primitive (e.g., a shell invocation or external command call) without proper sanitization, allowing arbitrary command injection under the privileges of the SAP application server's OS account.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and NVD description.

1. Reconnaissance / target identification. The attacker identifies SAP NetWeaver Application Server ABAP or ABAP Platform instances exposed on the network (common in large ERP estates). Discovery techniques include banner grabbing of the SAP ICM HTTP service, RFC gateway probing, or enumeration of ABAP stack metadata. The attacker then acquires or already possesses high-privilege credentials or a hijacked high-privilege session (e.g., via credential theft, insider access, or another vulnerability). Without high-privilege access, this CVE is not reachable.

2. Triggering the vulnerable code path. Using the high-privilege access, the attacker invokes the internal code path identified as lacking security controls. At the vulnerability-class level for CWE-78, the attacker submits crafted input — likely incorporating shell metacharacters such as ;, |, &&, `, $(...), or newline separators — in a parameter or payload that the vulnerable code passes into an OS command construction routine. The absence of proper neutralization means these characters are interpreted by the underlying shell rather than treated as data.

3. Payload / execution method. The injected content is concatenated into a command executed by the operating system under the service account running the SAP application server (not the SAP user's personal OS account). Typical class-level payloads would append an attacker-chosen command after the legitimate command, e.g., redirecting output or executing a follow-on utility. Because the NVD description does not disclose the trigger endpoint, parameter names, or command context, specific payload strings cannot be provided without fabrication.

4. Post-exploitation impact. Successful execution allows the attacker to perform OS-level actions: writing files to the operating system (low integrity impact) — potentially planting web shells, modifying configuration, or staging further tooling — and/or stopping the SAP system (high availability impact), e.g., by terminating the application server processes or issuing an OS-level shutdown/stop sequence that halts the ABAP work processes and the SAP instance. The attack can disrupt SAP-dependent business operations (ERP, S/4HANA, Business Suite) for the affected system. No confidentiality impact is reported.

The attack chain is consistent with MITRE ATT&CK technique T1059 (Command and Scripting Interpreter), with the OS command execution occurring from within the SAP runtime context.

Impact Assessment

CVE-2026-58236 carries a CVSS base score of 5.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H.

• Availability (High): The most consequential impact. An attacker who stops the SAP system halts core business processes that depend on the ABAP stack, including financials, logistics, HR, and reporting. Recovery requires manual restart and may incur lengthy startup sequences, resulting in significant operational downtime.
• Integrity (Low): File-write capability to the OS allows tampering with files owned by the SAP service account. Common abuse of such a primitive is persistent webshell deployment, modification of SAP runtime configuration, or replacement of binaries/scripts — though the advisory assesses the integrity impact as low, suggesting limited write scope or elevated effort.
• Confidentiality (None): No data disclosure is indicated by the CVSS vector.
• Blast radius: SAP NetWeaver AS ABAP is the foundation for SAP ERP, SAP S/4HANA, and many Business Suite products. The blast radius is the SAP system itself plus any connected systems that trust its identity, the OS host, and integrated file systems. Network segmentation and SAP system landscape design determine whether the host can be used as a pivot point.
• Exploit likelihood: EPSS score 0.00376 (30.8th percentile) indicates a low current probability of exploitation in the wild; the vulnerability is not on the CISA KEV list. However, patch confidence is 0/4 — the flaw is unpatched in all tracked sources — meaning the risk profile will increase over time as reverse engineering and analysis of the ABAP stack continue.

Detection Guidance

No indicators of compromise, exploit artifacts, or in-the-wild campaigns are known at the time of writing. The detection rules below focus on the observable consequence of the vulnerability class: an OS command interpreter or unexpected process being spawned from the SAP NetWeaver ABAP runtime context on the host, and network payloads carrying shell command-injection patterns destined for SAP services. The rules are intentionally generic because specific endpoints, parameters, and file paths are not disclosed in the advisory. Adapt process names to the confirmed SAP process list for your environment.

Sigma Rule

title: Suspicious OS Command Execution from SAP NetWeaver ABAP Processes
id: 3f6b8a1c-5823-4e9a-9c42-2e6f58236cde
status: experimental
description: Detects command interpreters launched by SAP NetWeaver ABAP application server processes, potentially indicating OS command execution via CVE-2026-58236 (internal code path, missing security controls).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58236
    - https://cwe.mitre.org/data/definitions/78.html
author: Valtersit Threat Intelligence
date: 2026/05/28
tags:
    - attack.t1059
    - attack.execution
    - cve.2026-58236
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\disp+work.exe'
            - '\dw_work.exe'
            - '\sapstartsrv.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - '/c '
            - '-enc '
            - '-Command'
    condition: selection_parent and selection_child
    falsepositives:
        - Legitimate SAP BASIS administrative scripts or maintenance tasks executed by administrators on the application server
    level: high

YARA Rule

rule CVE_2026_58236_SAP_ABAP_OS_Command_Injection
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects OS command injection payload patterns consistent with CVE-2026-58236 exploitation attempts against SAP NetWeaver ABAP (CWE-78)"
        cve         = "CVE-2026-58236"
        cwe         = "CWE-78"
        date        = "2026-05-28"

    strings:
        $s_cmd1 = "cmd.exe" ascii wide nocase
        $s_cmd2 = "cmd /c" ascii wide nocase
        $s_sh1  = "/bin/sh" ascii nocase
        $s_sh2  = "/bin/bash" ascii nocase
        $s_sh3  = "-c " ascii wide
        $s_inj1 = "|whoami" ascii wide nocase
        $s_inj2 = ";whoami" ascii wide nocase
        $s_inj3 = "&&id" ascii wide nocase
        $s_inj4 = "|ipconfig" ascii wide nocase
        $s_inj5 = "|ifconfig" ascii wide nocase
        $s_inj6 = "$(" ascii
        $s_inj7 = "`whoami" ascii wide

    condition:
        any of ($s_inj*) and any of ($s_cmd*)
        or (any of ($s_sh*) and $s_sh3)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT SAP NetWeaver ABAP OS Command Injection Attempt (CVE-2026-58236)"; flow:established,to_server; content:"POST"; http_method; nocase; http.request_body; pcre:"/((cmd(\.exe)?\s*\/c)|(\/(bin\/)?(ba)?sh\s*-c)|([|;&`]\s*(whoami|id|uname|ipconfig|ifconfig|netstat|wget|curl)))/i"; classtype:attempted-admin; sid:20358236; rev:1; metadata:created_at 2026_05_28, updated_at 2026_05_28, cve CVE-2026-58236;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("disp+work.exe", "dw_work.exe", "sapstartsrv.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "sh", "bash", "zsh")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where match(parent_process, "(?i)(disp\+work|dw_work|sapstartsrv)")
  AND match(New_Process_Name, "(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|/bin/sh|/bin/bash)")
| table _time, host, user, parent_process, New_Process_Name, CommandLine
| sort - _time
| head 100

Wazuh OSSEC Rule

<group name="sap,cve-2026-58236,">
  <rule id="582360" level="12">
    <decoded_as>windows</decoded_as>
    <field name="win.system.eventID">^1$</field>
    <field name="win.eventdata.parentImage" type="pcre2">(?i)(disp\+work|dw_work|sapstartsrv)</field>
    <field name="win.eventdata.image" type="pcre2">(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|/bin/(ba)?sh)</field>
    <description>SAP NetWeaver ABAP process spawned a command interpreter - possible OS command execution related to CVE-2026-58236</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>sap_os_command_execution,</group>
  </rule>
</group>

Note: The Wazuh rule above is written for Sysmon process-creation events (EventID 1) on Windows hosts and requires an appropriate Sysmon decoder. For Linux-based SAP application servers, adapt the rule to auditd execve events and match the SAP process names native to that host.

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source. The vendor fix is listed as N/A, and no affected version ranges have been published, which impedes version-based risk triage.

1. Immediate mitigations (while unpatched):

   • Restrict and inventory high-privilege ABAP authorization profiles (e.g., SAP_ALL and similar administrator roles). Enforce least privilege and separation of duties so that no single account holds excessive administrative rights that can reach internal code paths.
   • Enable and monitor the SAP Security Audit Log; alert on high-risk activities performed by privileged users, especially transactions/reports that invoke OS-level functions.
   • Segment SAP application servers from the general corporate network and from the internet. Restrict access to SAP ICM, RFC gateway, and diagnostic services to trusted administrative networks via firewall rules and SAP router configuration.
   • Run the SAP application server OS service account with the minimum privileges required (no local administrator/root rights).
   • Deploy file integrity monitoring on the OS directories where the SAP system runs to detect unauthorized file writes.
   • Apply the detection rules above on endpoints and network sensors to catch early signs of OS command execution from the ABAP runtime.

2. Patch / upgrade steps:

   • Monitor the SAP Security Notes portal and SAP Security Patch Day announcements for a Hot News / security note corresponding to CVE-2026-58236.
   • Until a note is released, no supported patch application is possible; treat the affected systems as high-risk for availability.
   • When the patch becomes available, apply the corresponding SAP note via the standard SAP maintenance transaction stack and then run comprehensive regression testing in the SAP test/quality landscape before production rollout.
   • Document the current system version and Support Package level so that patch applicability can be verified immediately once the advisory is published.

3. Long-term hardening:

   • Establish a vulnerability management process that tracks SAP security notes and maps them to all ABAP-based systems in the landscape, including dev/test systems, which often lag behind production patching.
   • Harden the underlying OS: disable unnecessary shell access for service accounts, enforce application allowlisting, and implement host-based intrusion detection.
   • Regularly review ABAP authorizations using tools such as SAP GRC or custom audit reports; remove dormant high-privilege accounts and rotate credentials for administrative users.
   • Monitor the CISA KEV catalog and EPSS updates for changes in exploitation status; elevate detection posture if evidence of in-the-wild exploitation emerges.
   • Do not disable OS-level logging on SAP application servers; retain process-creation and audit logs centrally for at least the enterprise retention period.

References

• NVD Entry: CVE-2026-58236 — https://nvd.nist.gov/vuln/detail/CVE-2026-58236
• CWE-78: Improper Neutralization of Special Elements used in an OS Command — https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK: T1059 — Command and Scripting Interpreter — https://attack.mitre.org/techniques/T1059/
• SAP Security Notes portal / Security Patch Day — https://support.sap.com/en/my-support/knowledge-base/security-notes.html
• FIRST EPSS (Exploit Prediction Scoring System) — https://www.first.org/epss/

Additional notes: CVE-2026-58236 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing. No PoC, Nuclei template, or exploit code has been observed publicly, and no threat-actor campaign has been attributed to this CVE. Exploitation-in-the-wild evidence is absent; the attack chain presented above is inferred strictly from the NVD description and the CWE-78 vulnerability class.