Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202608-00000010

SAP released its August routine updates, including 4 high-risk cybersecurity vulnerabilities.

【CVE-2026-58231, CVSS: 10.0】SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions that lack complete validation. Successful exploitation of this vulnerability may lead to arbitrary code execution and compromise internal components.

【CVE-2026-34265, CVSS: 9.8】SAP NetWeaver and ABAP Platform allow an unauthenticated attacker to exploit a logic error in DIAG protocol parsing, which may result in memory corruption, disclosure of sensitive system information, or system crashes.

【CVE-2026-44758, CVSS: 9.1】SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to submit specially crafted input to certain affected functions. Without sufficient validation, successful exploitation of this vulnerability may allow the attacker to execute arbitrary commands on the underlying operating system.

【CVE-2026-58243, CVSS: 8.8】Certain functions of SAP ABAP Developer Tools do not perform the required authorization checks, allowing a lower-privileged attacker to perform unauthorized database operations on SAP NetWeaver AS ABAP. Successful exploitation of this vulnerability may allow the attacker to read sensitive data, modify application data, and disrupt access by legitimate users.