CVE-2026-58242 · CVSS 3.0 3.5 · SAP Note 3767634
SAP Cloud Connector 2.19.1 adds an authorization check for an issue that could expose limited information about internal systems. CVE-2026-58242 requires both a low-privileged account and access from an adjacent network. SAP rates it Low priority, CVSS 3.5.
What the rating describes
The note reports a confidentiality impact only. Integrity and availability are unaffected in SAP’s assessment, and no victim interaction is required. SAP includes SSRF among the advisory’s technical terms, but the described outcome is limited internal-system information disclosure. It should not be presented as unauthenticated remote takeover of Cloud Connector.
The fixed release
SAP states that the correction is available from Cloud Connector 2.19.1. Obtain the fixed release from SAP’s software distribution channel and follow the Cloud Connector upgrade procedure linked in Note 3767634. The component table uses SAP_CLOUD_CONNECTOR 2.0 as its product-family entry; the actionable fixed product version in the solution text is 2.19.1.
Fit the update into connectivity maintenance
Check which connector instances and standby instances are deployed, then arrange the upgrade with the team responsible for cloud-to-on-premise connectivity. Confirm the running version and normal connection status after the change. Review low-privileged access and adjacent-network reachability as part of prioritization. Those controls help assess exposure; SAP’s release update supplies the authorization correction itself.
Advisory details
Component: BC-MID-SCC
SAP priority: Correction with low priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 6
CVSS vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: SAP Security Note 3767634 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
