CVE-2026-58246 describes a vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform where sensitive session identifier information is exposed in diagnostic trace logs when tracing is enabled by a privileged user. An attacker who can access these trace logs may extract session identifiers, allowing them to impersonate legitimate users within the session validity period. The vulnerability affects confidentiality but does not impact integrity or availability. The CVSS 3.1 base score is 4.3, reflecting a medium severity with attack vector requiring adjacent network access, low attack complexity, high privileges, and user interaction required. No patch or remediation level has been provided by the vendor at this time.

Exposure of sensitive session identifiers in diagnostic traces can lead to unauthorized user impersonation during the validity period of those identifiers, compromising confidentiality. There is no impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to diagnostic trace data to trusted privileged users only and avoid enabling tracing unnecessarily. Monitor vendor communications for updates on remediation.