CVE-2026-0488: Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-10 · updated 2026-06-17
Weakness: CWE-862

Description

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Affected products

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 700
SAP S/4Hana: 102, 103, 104, 105, 106, 107 (+2)
SAP Webclient Ui Framework: 700, 701, 730, 731, 746, 747 (+3)

References

Get alerted when CVE-2026-0488 or the next vulnerability affects your stack