CVE-2026-0487

HighCVSS 8.4/10Last modified Oct 24, 2026

Description

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-04889.9An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute u CVE-2026-04896.1Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthentic CVE-2026-04907.5SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks t CVE-2026-04919.1SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. Thi CVE-2026-04928.8SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user po CVE-2026-04934.3Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute stat CVE-2026-04944.3Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would CVE-2026-04955.1SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which CVE-2026-04966.6SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) witho CVE-2026-04974.3SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This CVE-2026-04987.2SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module expose CVE-2026-04996.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect