CVE-2026-0498: Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-06-17
Weakness: CWE-94

Description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected products

SAP_SE S4 HANA ABAP (Manage checkbook apps): 102, 103, 104, 105, 106, 107 (+2)

References

Get alerted when CVE-2026-0498 or the next vulnerability affects your stack