What’s Vulnerable › Vulnerabilities

CVE-2026-0491: Code Injection vulnerability in SAP Landscape Transformation

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-94

Description

SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected products

• SAP_SE SAP Landscape Transformation: DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020

References

• https://me.sap.com/notes/3697979
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-0491 or the next vulnerability affects your stack