by Kastro
Paper/Archive/CVE-2026-0488

CVE-2026-0488

SAP_SE SAP CRM and SAP S/4HANA (Scripting Editor) — Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA, NVD agree)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 45.5.455 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Affected

ProductAffectedFixed inSource
SAP CRM and SAP S/4HANA (Scripting Editor)S4FND 102–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)103–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)104–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)105–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)106–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)107–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)108–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)109–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)SAP_ABA 700–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)WEBCUIF 700–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)701–CNA
SAP CRM and SAP S/4HANA (Scripting Editor)730–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3697099refurl.sap/sapsecuritypatchday