CVE-2026-0500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0500", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:41.322Z", "datePublished": "2026-01-13T01:13:57.659Z", "dateUpdated": "2026-01-13T14:45:07.723Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Wily Introscope Enterprise Manager (WorkStation)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.</p>"}], "value": "Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:57.659Z"}, "references": [{"url": "https://me.sap.com/notes/3668679"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:45:00.338152Z", "id": "CVE-2026-0500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:45:07.723Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T14:45:00.338152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:45:04.536Z"}}], "cna": {"title": "Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Wily Introscope Enterprise Manager (WorkStation)", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3668679"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:57.659Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0500", "state": "PUBLISHED", "dateUpdated": "2026-01-13T14:45:07.723Z", "dateReserved": "2025-12-09T22:06:41.322Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-01-13T01:13:57.659Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Wily Introscope Enterprise Manager (WorkStation)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:introscope_enterprise_manager:10.8:*:*:*:*:*:*:*", "matchCriteriaId": "EB7AE9DD-2761-40DE-8E74-09AB4F93A8D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system."}, {"lang": "es", "value": "Debido al uso de un componente vulnerable de terceros en SAP Wily Introscope Enterprise Manager (WorkStation), un atacante no autenticado podr\u00eda crear un archivo JNLP (Java Network Launch Protocol) malicioso accesible a trav\u00e9s de una URL de acceso p\u00fablico. Cuando una v\u00edctima hace clic en la URL, el servidor Wily Introscope accedido podr\u00eda ejecutar comandos del sistema operativo en la m\u00e1quina de la v\u00edctima. Esto podr\u00eda comprometer completamente la confidencialidad, integridad y disponibilidad del sistema."}], "id": "CVE-2026-0500", "lastModified": "2026-06-17T10:10:51.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0500", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:45:00.338152Z", "version": "2.0.3"}}]}, "published": "2026-01-13T02:15:52.633", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3668679"}, {"source": "cna@sap.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:25:34.844902+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch referenced in Note 3668679 to update Introscope Enterprise Manager to a non\u2011vulnerable release.", "If a patch is unavailable, block external access to the Introscope server\u2019s JNLP endpoint using firewall or network policy, to prevent unauthenticated hosts from serving malicious files.", "Monitor web traffic and Alert on requests for .jnlp files originating from unknown sources, and investigate any suspicious download events."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "SAP Wily Introscope Enterprise Manager (WorkStation) version 10.8 from vendor SAP is affected.", "description_and_impact": "A vulnerable third\u2011party component in SAP Wily Introscope Enterprise Manager enables any unauthenticated user to host a malicious JNLP file behind a public URL. When a victim opens that URL the server executes arbitrary OS commands on the client machine, effectively compromising confidentiality, integrity, and availability. The flaw is a classic code injection (CWE-94).", "risk_and_exploitability": "The CVSS score of 9.6 indicates critical severity, yet the EPSS score is under 1\u2009%, suggesting low current exploitation probability. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker only needs to host the JNLP file on a publicly reachable URL and persuade a user to click it; no authentication or privileged access is required."}}}}, "created": "2026-01-13T09:26:56.185224+00:00", "updated": "2026-04-18T16:30:05.085438+00:00", "vendors": ["sap", "sap$PRODUCT$introscope_enterprise_manager"]}