CVE-2026-0504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0504", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:44.481Z", "datePublished": "2026-01-13T01:14:27.040Z", "dateUpdated": "2026-01-13T19:06:11.135Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Identity Management", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "IDM_CLM_REST_API 8.0"}, {"status": "affected", "version": "IDMIC 8.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.</p>"}], "value": "Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:14:27.040Z"}, "references": [{"url": "https://me.sap.com/notes/3657998"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Insufficient Input Handling in JNDI Operations of SAP Identity Management", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T19:05:49.758908Z", "id": "CVE-2026-0504", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:06:11.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T19:05:49.758908Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:05:57.563Z"}}], "cna": {"title": "Insufficient Input Handling in JNDI Operations of SAP Identity Management", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Identity Management", "versions": [{"status": "affected", "version": "IDM_CLM_REST_API 8.0"}, {"status": "affected", "version": "IDMIC 8.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3657998"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:14:27.040Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0504", "state": "PUBLISHED", "dateUpdated": "2026-01-13T19:06:11.135Z", "dateReserved": "2025-12-09T22:06:44.481Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-01-13T01:14:27.040Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Identity Management", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "IDM_CLM_REST_API 8.0"}, {"status": "affected", "version": "IDMIC 8.0"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability."}, {"lang": "es", "value": "Debido a un manejo insuficiente de entrada, la interfaz REST de SAP Identity Management permite a un administrador autenticado enviar solicitudes REST maliciosas especialmente dise\u00f1adas que son procesadas por operaciones JNDI sin una neutralizaci\u00f3n de entrada adecuada. Esto puede llevar a una divulgaci\u00f3n limitada o modificaci\u00f3n de datos, resultando en un bajo impacto en la confidencialidad y la integridad, sin impacto en la disponibilidad de la aplicaci\u00f3n."}], "id": "CVE-2026-0504", "lastModified": "2026-06-17T10:10:51.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0504", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T19:05:49.758908Z", "version": "2.0.3"}}]}, "published": "2026-01-13T02:15:53.110", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3657998"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:48:51.840649+00:00", "value": {"mitigation_remediation": ["Apply the SAP Security Note 3657998 or the corresponding SAP Security Patch Day update to address the input handling flaw. ", "Restrict administrative access to the REST interface and enforce least privilege so that only trusted accounts can send requests that trigger JNDI operations. ", "Implement input validation and sanitization for REST parameters that influence JNDI to neutralize malicious content, following the CWE\u2011943 mitigation guidance. "], "summary": {"action": "Assess Impact", "impact": "Limited disclosure or modification of data"}, "threat_synthesis": {"affected_systems": "SAP, product SAP Identity Management, with no specific version information available in the CNA data.", "description_and_impact": "The SAP Identity Management REST interface contains insufficient input handling that allows an authenticated administrator to send specially crafted malicious REST requests. These requests are processed by JNDI operations without adequate input neutralization, potentially enabling the attacker to disclose or modify data, leading to low impact on confidentiality and integrity and no impact on availability.", "risk_and_exploitability": "The vulnerability scores a CVSS of 3.8, indicating low severity, and an EPSS score of less than 1%, reflecting a very low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated administrator, a high\u2010privilege role, which limits its reach. The overall risk remains low but should be monitored."}}}}, "created": "2026-01-13T09:26:59.392253+00:00", "updated": "2026-04-18T07:00:11.341601+00:00", "vendors": ["sap", "sap$PRODUCT$identity_management"]}