Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3668679 | Permissions Required |
| https://url.sap/sapsecuritypatchday | Patch Vendor Advisory |
Configurations
History
22 Jan 2026, 18:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap
Sap introscope Enterprise Manager |
|
| CPE | cpe:2.3:a:sap:introscope_enterprise_manager:10.8:*:*:*:*:*:*:* | |
| References | () https://me.sap.com/notes/3668679 - Permissions Required | |
| References | () https://url.sap/sapsecuritypatchday - Patch, Vendor Advisory |
13 Jan 2026, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-13 02:15
Updated : 2026-01-22 18:47
NVD link : CVE-2026-0500
Mitre link : CVE-2026-0500
CVE.ORG link : CVE-2026-0500
JSON object : View
Products Affected
sap
- introscope_enterprise_manager
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')