CVE-2026-44756 and CVE-2026-58240: Critical Vulnerabilities in SAP Kernel and NetWeaver

# CVE-2026-44756 and CVE-2026-58240: Critical Vulnerabilities in SAP Kernel and NetWeaver

https://gcdradar.vercel.app/incidents/cve-2026-44756-and-cve-2026-58240-critical-vulnerabilities-i · AIR-2026-1556 · closed 2026-11-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical CVSS score of 10.0 and 9.8 reported.
- Fix status: Patched
- First reported: 2026-10-27 (happened 2026-09-08)
- AI role: No AI role
- Products: SAP Kernel, SAP NetWeaver Message Server
- CVE ids: CVE-2026-58240, CVE-2026-44756
- CVSS: 10

## Summary

SAP addressed critical vulnerabilities including a memory corruption flaw in SAP Extended Passport processing and a missing authentication check in the NetWeaver Message Server. Both vulnerabilities allow remote exploitation without authentication.

## What to do

Apply the September 2026 SAP Security Notes.

## Affected and fixed versions

- Affected: SAP Kernel
- Affected: SAP NetWeaver Message Server

## Latest updates

- 2026-10-27: 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server (https://cert.europa.eu/publications/security-advisories/2026-011)

## Sources

- 2026-10-27 CERT-EU: 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server https://cert.europa.eu/publications/security-advisories/2026-011

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.