CVE-2026-0498
Arbitrary Code Injection in SAP S/4HANA RFC Enables Full Compromise
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | s_4hana | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker with admin privileges to inject arbitrary code and bypass authorization checks, effectively creating a backdoor that risks full system compromise. Such a compromise undermines the confidentiality, integrity, and availability of the system, which are core principles required by common standards and regulations like GDPR and HIPAA. Therefore, exploitation of this vulnerability could lead to non-compliance with these regulations due to potential unauthorized access and data breaches.
Can you explain this vulnerability to me?
This vulnerability in SAP S/4HANA (Private Cloud and On-Premise) allows an attacker who already has admin privileges to exploit a flaw in a function module exposed via RFC. The attacker can inject arbitrary ABAP code or operating system commands into the system, bypassing important authorization checks. Essentially, this acts like a backdoor, enabling the attacker to take full control of the system.
How can this vulnerability impact me? :
The vulnerability can lead to a full system compromise, allowing an attacker to undermine the confidentiality, integrity, and availability of the SAP S/4HANA system. This means sensitive data could be exposed or altered, system operations disrupted, and overall trust in the system's security severely damaged.