What’s Vulnerable › Vulnerabilities
CVE-2026-0501: SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-13 · updated 2026-06-17
- Weakness: CWE-89
Description
Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application.
Affected products
- SAP_SE SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger): S4CORE 102, 103, 104, 105, 106, 107 (+2)
References
Get alerted when CVE-2026-0501 or the next vulnerability affects your stack