CVEvulnerability

CVE-2026-0498

7.2 HIGH Published 2026-01-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected configurations

• sap s\/4 hana 102 • sap s\/4 hana 103 • sap s\/4 hana 104 • sap s\/4 hana 105 • sap s\/4 hana 106 • sap s\/4 hana 107 • sap s\/4 hana 108 • sap s\/4 hana 109

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References