TL;DR: CVE-2026-58243 is a privilege escalation vulnerability in SAP ABAP Development Tools that lets a low-privileged user execute unauthorized database operations against SAP NetWeaver AS ABAP. NVD rates this CVSS 8.8 High (CWE-862, missing authorization). The attack requires network access and low-privilege credentials. Impact is high across confidentiality, integrity, and availability. Fix first, then audit developer access.

Fix first: what to do right now

SAP released this patch as part of August 2026 Security Patch Day. The security note is SAP Note 3772411. Apply it before anything else.

1. Log in to SAP Support Portal at support.sap.com and open SAP Note 3772411 for CVE-2026-58243.
2. Apply the patch to all systems where SAP ABAP Development Tools are installed or connected. This includes development, quality assurance, and production landscapes. Developers who have ADT installed locally on their workstations need to update their Eclipse plugin from tools.hana.ondemand.com [6].
3. Audit which users have low-privilege developer access to the affected ABAP system. Remove accounts that no longer need it. The vulnerability requires only low privileges to trigger, so every low-privilege developer account is a potential attack vector.
4. Review database audit logs for unauthorized operations executed through ADT connections. Look for unexpected SELECT, INSERT, UPDATE, or DELETE statements run by low-privilege users against tables outside their authorization scope.
5. Restrict developer access to production systems. ABAP Developer Tools should connect to development and QA landscapes, not production. If production access is required, time-box it and audit every session.

How the attack works

SAP ABAP Development Tools (ADT) is the Eclipse-based IDE that ABAP developers use to write, test, and deploy code on SAP NetWeaver AS ABAP. Developers connect ADT to an SAP system over the network, and the tool uses the ABAP backend as a development server. The developer authenticates with their SAP user credentials and operates within the authorization context assigned to that user.

The vulnerability is in the authorization model. ADT does not perform necessary authorization checks for certain functionality. A user holding low privileges can execute unauthorized database operations against the connected ABAP system. The operations bypass standard SAP authorization objects because ADT functionality was not properly gated.

The practical result: a developer with read-only or limited access can read sensitive data they should not see, modify application data, and disrupt access for other users. NVD rates this CVSS 8.8 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7]. Every dimension of impact is high. The attacker needs only low-privilege credentials and network access to the SAP system.

What makes this different from other SAP authorization bypass CVEs is the developer tooling angle. ADT sessions run database operations directly against the ABAP stack. Normal SAP transactions go through authorization checks at the transaction code level, the program level, and the authorization object level. ADT operates at a lower layer. It opens database perspectives, executes SQL queries, and manipulates repository objects. When ADT authorization checks are missing, the bypass happens beneath the standard transaction-level controls [6][8].

Who is affected

SAP ABAP Developer Tools connected to SAP NetWeaver AS ABAP. The hol.org CVE record does not list specific fixed versions. The patch is available through SAP Support.

ABAP Development Tools for Eclipse is the standard development environment for ABAP programmers at every SAP customer site. SAP distributes it through the Eclipse Marketplace and through the SAP Tools download site at tools.hana.ondemand.com [6]. Any organization running SAP ECC, SAP S/4HANA, or SAP BTP ABAP Environment that has developers using ADT is affected.

SAP does not publish exact ADT user counts, but the developer population is substantial. SAP's customer base of 440,000 organizations [4] includes tens of thousands of companies with active ABAP development teams. The Houlihan Lokey SAP industry report notes over 23,000 customers that need to migrate to S/4HANA by 2030 [4], and many of those migrations involve custom ABAP development work done through ADT.

The low-privilege requirement is the key narrowing factor. The attacker needs a valid SAP user account with at least minimal access to the system. In practice, that includes every developer, every support engineer, and every QA tester in the SAP landscape. Organizations with large ABAP development teams have hundreds of such accounts.

Why it matters

Developer tools are often treated as lower-risk attack surfaces because they require authenticated access. CVE-2026-58243 shows why that assumption fails. A developer with read-only permissions should not be able to modify application data or disrupt system availability. When the development tool bypasses authorization checks, the privilege boundary between a junior developer and a system administrator disappears.

The CWE-862 classification (missing authorization) is a design-level weakness, not a simple input validation bug. It means the affected functionality was built without the authorization checks that standard SAP transactions enforce. Patching closes the gap, but organizations should also review whether their ADT deployments follow least-privilege principles.

This CVE appeared in the same SAP Security Patch Day batch as CVE-2026-34265 (CVSS 9.8 unauthenticated memory corruption in the DIAG protocol). Security teams prioritizing the 9.8 should not deprioritize this 8.8. The two vulnerabilities target different layers of the same system: one exploits the protocol parser without credentials, the other exploits the developer tooling with low credentials. Together, they describe an SAP landscape where both the external attack surface and the internal developer access path need attention.

Context: what are SAP ABAP Development Tools?

SAP ABAP Development Tools (ADT) is an Eclipse plugin that provides a full development environment for ABAP programming. Before ADT, ABAP developers used SAP GUI with the ABAP Workbench (SE80 transaction). ADT brought modern IDE features to ABAP: syntax highlighting, code completion, refactoring, version control integration, and unit testing.

Developers install ADT as an Eclipse plugin by adding the update site https://tools.hana.ondemand.com/latest in Eclipse and selecting ABAP Development Tools [8]. They then create an ABAP project connecting to an SAP system, and work directly with repository objects on the backend. The connection is persistent and authenticated with SAP user credentials.

ADT communicates with the ABAP backend through HTTP and HTTPS using SAP's proprietary OData and SOAP services. When a developer runs a database query or edits a repository object in ADT, the tool sends a request to the ABAP backend, which executes it on the developer's behalf. That execution path is where the authorization gap exists.

References

• NVD: CVE-2026-58243
• hol.org: CVE-2026-58243
• SAP Note 3772411
• SAP Security Patch Day
• SAP Development Tools [6]
• SAP Tutorial: Install ABAP Development Tools [8]
• Houlihan Lokey: SAP Industry Overview 2024 [4]