CVE-2026-0498

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0498", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:39.790Z", "datePublished": "2026-01-13T01:13:41.371Z", "dateUpdated": "2026-02-26T15:04:49.230Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP S/4HANA (Private Cloud and On-Premise)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.</p>"}], "value": "SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:41.371Z"}, "references": [{"url": "https://me.sap.com/notes/3694242"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T04:57:10.297243Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:49.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T15:10:56.175870Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T15:10:58.868Z"}}], "cna": {"title": "Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP S/4HANA (Private Cloud and On-Premise)", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3694242"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:41.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0498", "state": "PUBLISHED", "dateUpdated": "2026-01-14T04:57:09.527Z", "dateReserved": "2025-12-09T22:06:39.790Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-01-13T01:13:41.371Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP S/4HANA (Private Cloud and On-Premise)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:s\\/4_hana:102:*:*:*:*:*:*:*", "matchCriteriaId": "7EE80980-12A5-40D7-8992-5C81FC82935E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:103:*:*:*:*:*:*:*", "matchCriteriaId": "82AAE66A-7112-4E83-9094-2AA571144F64", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:104:*:*:*:*:*:*:*", "matchCriteriaId": "CFF0FD31-F4F3-470A-9CB5-DE339D7334FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:105:*:*:*:*:*:*:*", "matchCriteriaId": "A52E5AE7-D16E-4122-A39E-20A2CAB9A146", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:106:*:*:*:*:*:*:*", "matchCriteriaId": "EAEF60F9-E053-4D22-AA65-9C1CA5130374", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:107:*:*:*:*:*:*:*", "matchCriteriaId": "8606117E-F864-474F-8839-F6BAB51113E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:108:*:*:*:*:*:*:*", "matchCriteriaId": "F794CB63-BF34-42D5-9998-CD2F2B2FF25F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4_hana:109:*:*:*:*:*:*:*", "matchCriteriaId": "CBF58A90-18F3-4358-8BCE-9FDD813F02C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system."}, {"lang": "es", "value": "SAP S/4HANA (Nube Privada y On-Premise) permite a un atacante con privilegios de administrador explotar una vulnerabilidad en el m\u00f3dulo de funci\u00f3n expuesto v\u00eda RFC. Esta falla permite la inyecci\u00f3n de c\u00f3digo ABAP/comandos de SO arbitrarios en el sistema, eludiendo comprobaciones de autorizaci\u00f3n esenciales. Esta vulnerabilidad funciona efectivamente como una puerta trasera, creando el riesgo de compromiso total del sistema, socavando la confidencialidad, integridad y disponibilidad del sistema."}], "id": "CVE-2026-0498", "lastModified": "2026-06-17T10:10:50.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0498", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T04:57:10.297243Z", "version": "2.0.3"}}]}, "published": "2026-01-13T02:15:52.300", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3694242"}, {"source": "cna@sap.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:50:35.850481+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch referenced in SAP Note\u00a03694242 to update the vulnerable RFC function module", "If a patch is not yet available, restrict or remove administrative privileges from users that can invoke the exposed RFC function and consider disabling the function module entirely", "Deploy monitoring to detect anomalous RFC activity, focusing on calls to the affected function module, and establish alerting for any unexpected command execution"], "summary": {"action": "Immediate Patch", "impact": "Code Injection leading to full system compromise"}, "threat_synthesis": {"affected_systems": "SAP S/4HANA (Private Cloud and On\u2011Premise) versions 10.2 through 10.9 are impacted, as evidenced by the associated CPE identifiers. The flaw exists in the function module that is made available via RFC calls in these releases.", "description_and_impact": "The vulnerability is a code injection flaw in SAP S/4HANA\u2019s RFC\u2011exposed function module. An attacker who has administrative privileges can inject arbitrary ABAP code or operating\u2011system commands, bypassing the system\u2019s authorization checks. This capability effectively creates a backdoor that allows the attacker to read, modify, or delete data, disrupt services, or otherwise take full control of the system.", "risk_and_exploitability": "The flaw carries a CVSS v3.1 score of 9.1, indicating critical severity. The EPSS score is reported as less than 1\u202f%, implying a low probability that the vulnerability will be exploited in the wild, and it is not currently listed in the CISA KEV catalog. Attackers must possess administrative rights and must invoke the vulnerable RFC function module. Once the payload is delivered, the attacker can execute arbitrary code with the system\u2019s privileges, potentially resulting in a full compromise of confidentiality, integrity, and availability."}}}}, "created": "2026-01-13T09:27:00.030403+00:00", "updated": "2026-04-18T07:00:11.343799+00:00", "vendors": ["sap", "sap$PRODUCT$s/4hana"]}