This vulnerability (CVE-2026-58241) involves missing authorization checks in the Customer Transport Integration Wizard component of SAP NetWeaver and ABAP Platform's Change and Transport System. A low-privileged user can modify configuration tables that govern access to data objects during specific operations. The unauthorized changes may lead to processing delays and operational disruptions, resulting in a low impact on the integrity and availability of the affected application. There is no impact on confidentiality. The CVSS 3.1 base score is 4.2, reflecting medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and unchanged scope.

The vulnerability allows unauthorized modification of configuration tables controlling access to data objects, which can cause processing delays and operational disruption. This results in a low impact on the integrity and availability of the SAP application. There is no impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level is currently provided by the vendor. Organizations should monitor SAP advisories for updates and consider restricting low-privileged user access to the affected component as a precaution.