CVE-2026-0488

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-0488
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3697099 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:109:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:746:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:747:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:801:*:*:*:*:*:*:*
History

17 Feb 2026, 16:10

Type Values Removed Values Added
References () https://me.sap.com/notes/3697099 - () https://me.sap.com/notes/3697099 - Permissions Required
References () https://url.sap/sapsecuritypatchday - () https://url.sap/sapsecuritypatchday - Vendor Advisory
CPE cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:746:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:109:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:801:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:747:*:*:*:*:*:*:*
First Time Sap
Sap webclient Ui Framework
Sap netweaver Application Server Abap
Sap s\/4hana
Summary
  • (es) Un atacante autenticado en SAP CRM y SAP S/4HANA (Editor de scripts) podría explotar una vulnerabilidad en una llamada a un módulo de función genérico y ejecutar funcionalidades críticas no autorizadas, lo que incluye la capacidad de ejecutar una sentencia SQL arbitraria. Esto conduce a un compromiso total de la base de datos con alto impacto en la confidencialidad, integridad y disponibilidad.

10 Feb 2026, 04:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-10 04:16

Updated : 2026-02-17 16:10

NVD link : CVE-2026-0488

Mitre link : CVE-2026-0488

CVE.ORG link : CVE-2026-0488

JSON object : View

Products Affected

sap

  • webclient_ui_framework
  • netweaver_application_server_abap
  • s\/4hana
CWE
CWE-862

Missing Authorization