Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-0498

Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP S/4HANA (Private Cloud and On-Premise)

Default version status: unaffected

  • S4CORE 102affected
  • 103affected
  • 104affected
  • 105affected
  • 106affected
  • 107affected
  • 108affected
  • 109affected

References