CVE-2026-0498

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-0498
SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3694242 Permissions Required
https://url.sap/sapsecuritypatchday Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:s\/4_hana:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:109:*:*:*:*:*:*:*
History

17 Jun 2026, 10:10

Type Values Removed Values Added
Summary
  • (es) SAP S/4HANA (Nube Privada y On-Premise) permite a un atacante con privilegios de administrador explotar una vulnerabilidad en el módulo de función expuesto vía RFC. Esta falla permite la inyección de código ABAP/comandos de SO arbitrarios en el sistema, eludiendo comprobaciones de autorización esenciales. Esta vulnerabilidad funciona efectivamente como una puerta trasera, creando el riesgo de compromiso total del sistema, socavando la confidencialidad, integridad y disponibilidad del sistema.

22 Jan 2026, 18:44

Type Values Removed Values Added
References () https://me.sap.com/notes/3694242 - () https://me.sap.com/notes/3694242 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Patch, Vendor Advisory
CPE cpe:2.3:a:sap:s\/4_hana:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:109:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4_hana:105:*:*:*:*:*:*:*
First Time Sap s\/4 Hana
Sap

13 Jan 2026, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-13 02:15

Updated : 2026-06-17 10:10

NVD link : CVE-2026-0498

Mitre link : CVE-2026-0498

CVE.ORG link : CVE-2026-0498

JSON object : View

Products Affected

sap

  • s\/4_hana
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')