CVE-2026-58241

Executive Summary

CVE-2026-58241 is an unpatched missing-authorization vulnerability (CWE-862) in the SAP NetWeaver and ABAP Platform Change and Transport System (CTS) Customer Transport Integration (CTI) Wizard. A low-privileged, network-reachable user can modify configuration tables that control access to data objects during transport operations, resulting in processing delays, operational disruption, and low impact to the integrity and availability of the SAP application — with no impact on confidentiality. The vulnerability is rated CVSS 4.2 (High attack complexity, Low privileges required) and is not currently listed in CISA KEV; no public exploit code or PoC has been identified, and no vendor patch is available as of this report.

Technical Analysis

The vulnerability class is CWE-862 (Missing Authorization), meaning the affected component fails to enforce proper authorization checks before permitting a user to perform a privileged action. In the context of the SAP CTS Customer Transport Integration Wizard, the affected business function exposes the ability to modify configuration tables that govern access to data objects during "specific operations" — most plausibly transport release, import, or export processing. Because the authorization check is absent or incomplete, a low-privileged dialog or RFC user can invoke the same configuration-modification capability that should be reserved for transport administrators or security officers.

From a mechanics standpoint, the vulnerable interaction is application-layer: the low-privileged user issues an authenticated request (over HTTP(S), SAP GUI, or RFC via the SAP network layer) that reaches the CTI Wizard processing logic. The application apparently does not validate the user's authority against the relevant authorization objects controlling configuration-table maintenance, and instead honors the modification request. The NVD description does not disclose specific transaction codes, function modules, BAdI implementations, table names, or URL endpoints, and no code-level detail has been published by the vendor. Accordingly, this report deliberately describes the flaw at the vulnerability-class level and avoids fabricating implementation-specific identifiers.

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) provides meaningful insight into the attack surface:

• AV:N — the component is reachable over the network, meaning the SAP application server does not require physical or local-host access.
• AC:H — successful exploitation requires specific conditions. This likely relates to timing (the modification must occur "during specific operations" — e.g., while a transport request is in progress), a degree of insider knowledge about the CTS landscape, or the need to satisfy additional environmental prerequisites that raise the difficulty.
• PR:L — a low-privileged account, such as a standard dialog/business user with basic SAP access, is sufficient to trigger the flaw.
• UI:N — no user interaction by another user is required.
• C:N / I:L / A:L — confidentiality is not impacted; integrity of configuration tables is minimally impacted; availability of transport operations is minimally impacted (processing delays and operational disruption).

The EPSS score of 0.00158 (5.5th percentile of exploited CVEs) indicates that, as of the scoring date, there is no meaningful exploit-in-the-wild activity and the probability of near-term exploitation is low. However, the "unpatched" status and the SAP context (widely deployed in enterprise change-management environments) mean that once a patch is released — or if internal research discloses a concrete exploitation path — this score may rise sharply. The absence of a CNA title and affected-version list further limits the ability to scope vulnerable installations precisely; SAP customers should treat all CTS-enabled NetWeaver/ABAP Platform systems as potentially exposed until a vendor advisory is released.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code exists for CVE-2026-58241. The attack chain below is inferred strictly from the NVD description, the vulnerability class (CWE-862), and the CVSS vector.

Step 1 — Reconnaissance / target identification. An attacker with valid but low-privileged SAP credentials (a dialog user, or a user with basic RFC access) identifies an SAP NetWeaver or ABAP Platform system where the CTS Customer Transport Integration (CTI) Wizard is active. Typical reconnaissance includes querying the SAP system via RFC (e.g., via SAP GUI or a scripting client) to enumerate transport-management screens, or fingerprinting exposed SAP HTTP/ICM endpoints from the network. Because the vulnerability is network-exploitable, the target must be reachable through the enterprise network or via an exposed SAP application layer.

Step 2 — Triggering the flaw class. The attacker invokes the CTI Wizard functionality during a transport operation. The manipulation target is the set of configuration tables controlling access to data objects. Because the required authorization check is missing (CWE-862), the application processes the modification request from the low-privileged account without verifying administrative or transport-maintenance entitlement.

Step 3 — Payload / execution method. At the vulnerability-class level, this is an authorized, authenticated parameter/state modification of backend configuration: the user submits a valid application request altering the contents of the configuration tables. No injection payload or memory-corruption primitive is implied. The attacker leverages the application's own business logic with a low-privileged session; the "payload" is the malicious configuration state written into the tables (e.g., changed access-control flags governing which users or processes may access specific data objects during transport activities).

Step 4 — Post-exploitation impact. The unauthorized configuration modifications take effect on subsequent transport operations, producing processing delays and operational disruption. Examples consistent with the description include transport requests that stall, incorrect object-access resolution during import/export, or failures in the CTI workflow that delay release-to-production change cycles. The impact is limited to low integrity and low availability; there is no confidentiality impact, so data theft or credential access is not a demonstrated outcome at this point.

Important caveat: the description does not indicate that the modification directly escalates the user's own privileges. The business impact is disruption of the transport/change-management pipeline rather than full system takeover. Exploitation would likely be performed by a malicious insider (a low-privileged employee with legitimate network access) or by an external attacker who has already obtained low-privileged credentials through phishing, password reuse, or credential-stuffing.

Impact Assessment

The CVSS base score of 4.2 reflects a moderate-to-low severity issue, but the business impact must be assessed in the context of SAP change-management operations. The CTS is the backbone of code and configuration transport in SAP landscapes; disruption of transport processing directly affects an organization's ability to deploy changes, respond to incidents, and maintain audit-controlled change windows.

• Affected systems: SAP NetWeaver Application Server ABAP and SAP ABAP Platform installations where the CTS Customer Transport Integration Wizard is installed and active. Because no affected-version list has been published, all supported and legacy releases exposing the CTI Wizard should be considered candidates.
• Blast radius: The intrinsic impact scope is Unchanged (S:U) — the compromise does not extend to other authorization scopes. The blast radius is therefore limited to the transported configuration and the availability/integrity of the CTS functions on the affected system, not to connected backend databases or external cloud resources.
• Integrity impact (I:L): Configuration tables governing access to data objects can be tampered with, which may allow the attacker to manipulate which objects are accessible during specific operations — potentially enabling other malicious activities (e.g., altering the set of objects included in a transport) — but without direct modification of business data or applications.
• Availability impact (A:L): Processing delays and operational disruption of transport operations create a denial-of-service effect on the change-management pipeline. This can cause missed release windows, stalled transports, and manual intervention by Basis/transport administrators.
• Compliance/audit considerations: Unauthorized modification of configuration tables in a governed SAP environment may also constitute a violation of segregation-of-duties and change-management controls, creating audit findings under frameworks such as SOX, GDPR (where relevant to processing configuration), and internal ITIL controls.

There is no current evidence of exploitation in the wild, no CISA KEV listing, and no known threat-actor campaigns associated with this CVE. The EPSS percentile (5.5%) reinforces low near-term exploitation probability.

Detection Guidance

The detection rules below target activity consistent with CVE-2026-58241: low-privileged users interacting with SAP CTS CTI functionality and modifying configuration tables. Because the NVD description does not provide concrete table names, transaction codes, or HTTP endpoints, the rules use generic SAP artifact patterns and must be adapted to your organization's SAP audit-log configuration, network telemetry, and application-layer data. Validate all rules in a test environment before production deployment to reduce false positives.

Sigma Rule

title: SAP CTS Customer Transport Integration Wizard - Unauthorized Configuration Table Modification
id: 9f7c3d2e-1b6a-4c98-9e2d-5a8f4c1b7a03
status: experimental
description: >
  Detects low-privileged SAP dialog/RFC users performing configuration-table
  modification activity associated with the Change and Transport System (CTS)
  Customer Transport Integration (CTI) Wizard, potentially exploiting
  CVE-2026-58241 (CWE-862 Missing Authorization).
logsource:
  product: sap
  service: security_audit_log
  definition: >
    Requires SAP ABAP Security Audit Log with auditing of authorization
    failures, RFC calls, and table-change (AUTH) events enabled. Field names
    must be mapped to your SAP audit-log ingestion schema.
detection:
  selection_activity:
    Event_Class: "AU"          # Security audit log event class
    Action:                    # Generic: table modification / RFC invocation
      - "*table*"
      - "*change*"
      - "*RFC*"
  selection_context:
    Program: "*CTS*"           # CTS-associated program/transaction context
    Table_Name: "*CTS*"        # Config tables governing data-object access
  filter_privileged:
    User_Name:
      - "SAP*"
      - "DDIC"
      - "*ADMIN*"
  filter_no_op:
    Return_Code: "0"           # Successful modification when auth expected
  condition: selection_activity and selection_context and not filter_privileged
level: high
falsepositives:
  - Transport administrators performing legitimate maintenance under non-standard accounts
  - Authorized Basis team troubleshooting transport issues during change windows
tags:
  - attack.t1068
  - cve.2026-58241
  - cwe.862
  - sap.cts

YARA Rule

rule CVE_2026_58241_SAP_CTS_CTI_Configuration_Tamper
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects files, memory dumps, or network captures containing strings associated with SAP CTS Customer Transport Integration Wizard activity and transport configuration manipulation"
        cve = "2026-58241"
        cwe = "CWE-862"
        date = "2026-06-01"
        severity = "medium"

    strings:
        $s1 = "Customer Transport Integration" ascii wide nocase
        $s2 = "Change and Transport System" ascii wide nocase
        $s3 = "transport" ascii wide nocase
        $s4 = "configuration table" ascii wide nocase
        $s5 = "SAP" ascii wide nocase
        $s6 = "CTS" ascii wide nocase

    condition:
        // Match material that references the affected SAP component
        // and transport-configuration context (e.g., log files, packet captures,
        // documents exported from SAP by an attacker).
        2 of ($s1, $s2, $s4) and
        any of ($s3, $s6) and
        $s5
}

Suricata IDS Rule

# CVE-2026-58241 - SAP NetWeaver / ABAP Platform - CTS Customer Transport Integration
# Wizard unauthorized configuration table modification (CWE-862)
#
# NOTE: URI patterns are intentionally generic SAP/CTS markers because the vendor
# has not disclosed specific endpoints. Tune the URI content patterns to match
# observed SAP ICM paths in your environment to reduce false positives.
alert http any any -> any any (msg:"SAP CTS Customer Transport Integration Wizard Unauthorized Config Access Attempt (CVE-2026-58241)"; flow:established,to_server; content:"sap"; http_uri; nocase; content:"cts"; http_uri; nocase; content:"transport"; http_uri; nocase; content:"POST"; http_method; reference:cve,2026-58241; classtype:attempted-user; sid:2026582411; rev:1;)

# Additional coverage: detect HTTP responses referencing the CTI Wizard,
# which may indicate successful access and subsequent configuration changes.
alert http any any -> any any (msg:"SAP CTS CTI Wizard Configuration Modification Response (CVE-2026-58241)"; flow:established,from_server; content:"Customer Transport Integration"; http_server_body; nocase; reference:cve,2026-58241; classtype:policy-violation; sid:2026582412; rev:1;)

Elastic Detection

// CVE-2026-58241 - SAP CTS CTI Wizard unauthorized configuration modification
// Network layer: outbound/inbound HTTP(S) traffic to SAP application servers
// referencing CTS/transport functions from non-administrative source IPs.
network where network.protocol == "http"
    and http.request.direction == "outbound"
    and http.request.method in ("POST", "GET")
    and (http.request.uri like "*cts*" or http.request.uri like "*transport*")
    and http.request.uri like "*sap*"
    and not source.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

// Endpoint layer: SAP GUI / SAP Logon processes issuing transport-related
// activity from low-privileged user contexts. Process/command-line telemetry
// must include SAP transaction codes or RFC activity.
process where event.category == "process"
    and process.name : ("saplogon.exe", "sapgui.exe")
    and process.command_line like "*CTS*"
    and not user.name : ("Administrator", "SAP*", "DDIC", "*ADMIN*")

Splunk SPL Query

index=sap_auditlog sourcetype="sap:security:auditlog"
| search (Event_Class="AU" OR Action="*RFC*" OR Action="*CHANGE*")
    AND (Program="*CTS*" OR Table_Name="*CTS*" OR File_Name="*CTI*")
    AND User_Type="Dialog"
| search NOT User_Name IN ("SAP*", "DDIC", "*ADMIN*")
| eval cve_key="CVE-2026-58241"
| stats count, earliest(_time) AS first_seen, latest(_time) AS last_seen
    BY User_Name, Client, Terminating_IP, Table_Name, Program, Action
| where count > 1
| sort - count
| table first_seen, last_seen, User_Name, Client, Terminating_IP, Table_Name, Program, Action, count

Wazuh OSSEC Rule

<!--
  CVE-2026-58241 - SAP NetWeaver/ABAP Platform - CTS Customer Transport Integration
  Wizard unauthorized configuration table modification (CWE-862).
  Decoder prerequisite: a custom SAP security-audit-log decoder that populates
  fields event_class, table_name, program, user_name, and user_type.
-->
<group name="sap,access_control,cve_2026_58241,">
  <rule id="100582" level="12" frequency="3" timeframe="300">
    <decoded_as>sap_auditlog</decoded_as>
    <field name="event_class">AU</field>
    <field name="table_name" type="pcre2">.*CTS.*</field>
    <field name="program" type="pcre2">.*CTS.*</field>
    <field name="user_type">Dialog</field>
    <description>SAP: Possible CVE-2026-58241 exploitation - low-privileged user modifying CTS configuration tables</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <options>no_full_log</options>
    <group>sap_audit,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status is critical: CVE-2026-58241 is currently UNPATCHED (patch confidence 0/4). No SAP Security Note, hotfix, or version-level fix has been published by any tracked source, and the vendor fix field is marked N/A. The following actions are recommended immediately and in the longer term.

1) Immediate mitigations (compensating controls):

• Restrict access to the CTS Customer Transport Integration Wizard by enforcing authorization in transaction launch and RFC callbacks: remove the CTI Wizard profiles/roles from all non-administrative users, and ensure transport-management roles are assigned only to authorized Basis/transport administrators.
• If the CTI Wizard is not business-critical, disable or decommission it on NetWeaver/ABAP Platform systems until a patch is available.
• Apply network-layer access controls (firewall/IPS) so that only known SAP administration workstations and approved application servers can reach the CTS/transport endpoints; block direct Internet exposure of SAP ICM ports.
• Enable and actively review the SAP ABAP Security Audit Log for table-modification and RFC events, correlating with the detection rules above. Review transport-related logs (SE01/SE09/SE10 transaction logs) for anomalous activity by low-privileged accounts.
• Monitor for changes to configuration tables referenced in the NVD description (access-control/data-object configuration) via table-logging (generic table logging / technical settings) and alert on unauthorized modifications.

2) Patch/upgrade steps:

• Continuously monitor the SAP Security Notes portal (https://support.sap.com/en/my-support/knowledge-base/security-notes.html) for an SAP Security Note referencing CVE-2026-58241. SAP typically releases security notes on the monthly patch day (second Tuesday); prioritize this CVE for immediate application once available.
• Subscribe to SAP support portal alerts and the SAP Security Patch Day announcement list.
• After the note is released, test the note implementation in a non-production SAP system first, then apply to production within the organization's change-window procedure. Re-run the detection rules after patching to confirm the attack surface is closed.

3) Long-term hardening:

• Implement the SAP Security Baseline Template and SAP's Secure Configuration guidelines for NetWeaver/ABAP Platform, including strict authorization-trace analysis with transaction SUIM (SAP User Information System) to identify users with conflicting roles.
• Enforce least privilege across SAP roles: default user IDs (SAP*, DDIC, TMSADM) should be locked or limited, and all dialog users should be reviewed periodically.
• Establish segregation of duties between transport request creation, transport release, and table-maintenance authorizations.
• Harden network exposure: place SAP application servers behind a reverse proxy or SAP Web Dispatcher with strong authentication, and use encrypted channels for RFC/DIAG traffic.
• If the organization uses SAP Solution Manager / Focused Run, integrate CTS monitoring into incident-response workflows so that transport pauses and configuration drift automatically generate security alerts.
• Reassess EPSS and CISA KEV feeds weekly for CVE-2026-58241 to detect a change in exploit status; if exploitation is observed in the wild, elevate the response posture immediately.

References

1. NVD Entry — CVE-2026-58241: https://nvd.nist.gov/vuln/detail/CVE-2026-58241
2. SAP Security Notes Portal (monitor for the forthcoming SAP Security Note): https://support.sap.com/en/my-support/knowledge-base/security-notes.html
3. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. FIRST EPSS — CVE-2026-58241 Score Information: https://www.first.org/epss/

Exploit-in-the-wild evidence: None at the time of writing. CVE-2026-58241 is NOT listed in CISA Known Exploited Vulnerabilities (KEV) catalog. No threat-actor campaigns, blog write-ups, or public exploit code have been identified. Patch confidence is 0/4 — treat this CVE as unpatched and actively monitor for a vendor advisory.