CVE-2026-0507

{"id": "CVE-2026-0507", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}]}, "published": "2026-01-13T02:15:53.427", "references": [{"url": "https://me.sap.com/notes/3675151", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system\ufffds confidentiality, integrity, and availability."}, {"lang": "es", "value": "Debido a una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en SAP Servidor de aplicaciones para ABAP y SAP NetWeaver RFCSDK, un atacante autenticado con acceso administrativo y acceso a la red adyacente podr\u00eda cargar contenido especialmente dise\u00f1ado al servidor. Si es procesado por la aplicaci\u00f3n, este contenido permite la ejecuci\u00f3n de comandos arbitrarios del sistema operativo. La explotaci\u00f3n exitosa podr\u00eda llevar a un compromiso total de la confidencialidad, integridad y disponibilidad del sistema."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "cna@sap.com"}