CVE-2026-58242

SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.

• CWE-191

• https://me.sap.com/notes/3767634
• https://url.sap/sapsecuritypatchday

Published

Oct 13, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58237WebSocket of SAP Approuter does not perform sufficient autho…5.9
• CVE-2026-58238SAP Approuter does not sufficiently handle certain requests …5.9
• CVE-2026-58239SAP Approuter does not sufficiently validate tenant context …3.7
• CVE-2026-5824A security vulnerability has been detected in code-projects …7.3
• CVE-2026-58240SAP NetWeaver Message Server does not sufficiently validate …9.8
• CVE-2026-58241SAP NetWeaver and ABAP Platform (Change and Transport System…4.2
• CVE-2026-58243SAP ABAP Development Tools does not perform necessary author…8.8
• CVE-2026-58244SAP Manufacturing Integration and Intelligence (MII) does no…4.3
• CVE-2026-58245SAP Advanced Planning and Optimization (Model Mix Planning) …3.8
• CVE-2026-58246SAP NetWeaver Application Server for ABAP and ABAP Platform …4.3
• CVE-2026-58247SAP ABAP Platform allows an unauthenticated user to send a s…5.3
• CVE-2026-58248SAP BusinessObjects Business Intelligence Platform (Web Inte…6.5