CVE-2026-0500

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3668679	Permissions Required
https://url.sap/sapsecuritypatchday	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:introscope_enterprise_manager:10.8:*:*:*:*:*:*:*

History

17 Jun 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Debido al uso de un componente vulnerable de terceros en SAP Wily Introscope Enterprise Manager (WorkStation), un atacante no autenticado podría crear un archivo JNLP (Java Network Launch Protocol) malicioso accesible a través de una URL de acceso público. Cuando una víctima hace clic en la URL, el servidor Wily Introscope accedido podría ejecutar comandos del sistema operativo en la máquina de la víctima. Esto podría comprometer completamente la confidencialidad, integridad y disponibilidad del sistema.

22 Jan 2026, 18:47

Type	Values Removed	Values Added
First Time		Sap Sap introscope Enterprise Manager
CPE		cpe:2.3:a:sap:introscope_enterprise_manager:10.8:::::::*
References	~~() https://me.sap.com/notes/3668679 -~~	() https://me.sap.com/notes/3668679 - Permissions Required
References	~~() https://url.sap/sapsecuritypatchday -~~	() https://url.sap/sapsecuritypatchday - Patch, Vendor Advisory

13 Jan 2026, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-13 02:15

Updated : 2026-06-17 10:10

NVD link : CVE-2026-0500

Mitre link : CVE-2026-0500

CVE.ORG link : CVE-2026-0500

JSON object : View

Products Affected

sap

introscope_enterprise_manager

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-0500", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0500", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T14:45:00.338152Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Wily Introscope Enterprise Manager (WorkStation)", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-13T02:15:52.633", "references": [{"url": "https://me.sap.com/notes/3668679", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Patch", "Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system."}, {"lang": "es", "value": "Debido al uso de un componente vulnerable de terceros en SAP Wily Introscope Enterprise Manager (WorkStation), un atacante no autenticado podr\u00eda crear un archivo JNLP (Java Network Launch Protocol) malicioso accesible a trav\u00e9s de una URL de acceso p\u00fablico. Cuando una v\u00edctima hace clic en la URL, el servidor Wily Introscope accedido podr\u00eda ejecutar comandos del sistema operativo en la m\u00e1quina de la v\u00edctima. Esto podr\u00eda comprometer completamente la confidencialidad, integridad y disponibilidad del sistema."}], "lastModified": "2026-06-17T10:10:51.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:introscope_enterprise_manager:10.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB7AE9DD-2761-40DE-8E74-09AB4F93A8D6"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}