CVE-2026-0498

Published: Jan 13, 2026Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected (8)

Products: Sap: S/4 Hana

Sap

1 product

S/4 Hana

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Sap S/4 Hana	Version 102
Sap S/4 Hana	Version 103
Sap S/4 Hana	Version 104
Sap S/4 Hana	Version 105
Sap S/4 Hana	Version 106
Sap S/4 Hana	Version 107
Sap S/4 Hana	Version 108
Sap S/4 Hana	Version 109

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://me.sap.com/notes/3694242

Source: cna@sap.com

Permissions Required

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

PatchVendor Advisory

Timeline

No history available yet.