CVE-2026-0487

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0487", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:31.239Z", "datePublished": "2026-07-14T00:17:37.478Z", "dateUpdated": "2026-07-20T14:39:04.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-07-14T00:17:37.478Z"}, "title": "DLL Hijacking vulnerability in SAProuter on Microsoft Windows", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAProuter on Microsoft Windows", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "SAP_ROUTER 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.17"}, {"status": "affected", "version": "9.18"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3692165"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T12:39:52.767116Z", "id": "CVE-2026-0487", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:40:00.804Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-20T14:39:04.209Z"}, "references": [{"url": "https://github.com/piuppi/Proof-of-Concepts/blob/main/SAP/CVE-2026-0487.md"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/piuppi/Proof-of-Concepts/blob/main/SAP/CVE-2026-0487.md"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-20T14:39:04.209Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0487", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T12:39:52.767116Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:39:57.460Z"}}], "cna": {"title": "DLL Hijacking vulnerability in SAProuter on Microsoft Windows", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAProuter on Microsoft Windows", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "SAP_ROUTER 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.17"}, {"status": "affected", "version": "9.18"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3692165"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.", "supportingMedia": [{"type": "text/html", "value": "<p>SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-07-14T00:17:37.478Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0487", "state": "PUBLISHED", "dateUpdated": "2026-07-20T14:39:04.209Z", "dateReserved": "2025-12-09T22:06:31.239Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-07-14T00:17:37.478Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAProuter on Microsoft Windows", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "SAP_ROUTER 7.53"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.17"}, {"status": "affected", "version": "9.18"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system."}, {"lang": "es", "value": "SAProuter en Microsoft Windows permite a un atacante no autenticado cargar archivos de biblioteca (DLL) desde una ubicaci\u00f3n no confiable, lo que les permite ejecutar c\u00f3digo malicioso en el sistema. Esto podr\u00eda permitir al atacante secuestrar el proceso de carga de DLL y lograr la ejecuci\u00f3n de c\u00f3digo arbitrario. Esto tiene un alto impacto en la confidencialidad, integridad y disponibilidad del sistema."}], "id": "CVE-2026-0487", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0487", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T12:39:52.767116Z", "version": "2.0.3"}}]}, "published": "2026-07-14T01:16:16.370", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3692165"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/piuppi/Proof-of-Concepts/blob/main/SAP/CVE-2026-0487.md"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KRNL64NUC 7.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.22EXT"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KRNL64UC 7.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.53"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_ROUTER 7.53"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.54"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KERNEL 7.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.77"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.89"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.93"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.18"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SAProuter on Microsoft Windows", "source": "cna", "vendor": "SAP_SE"}, "product": "saprouter_on_microsoft_windows", "vendor": "sap_se"}], "created": "2026-07-14T13:00:04.571149+00:00", "updated": "2026-07-31T11:00:06.457500+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$saprouter_on_microsoft_windows"]}