CVE-2026-0488

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP CRM and SAP S/4HANA (Scripting Editor)	S4FND 102; 103; 104; 105; 106; 107; 108; 109; SAP_ABA 700; WEBCUIF 700; 701; 730; 731; 746; 747; 748; 800; 801

References

https://me.sap.com/notes/3697099Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04896.1Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthentic CVE-2026-04907.5SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks t CVE-2026-04919.1SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. Thi CVE-2026-04928.8SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user po CVE-2026-04934.3Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute stat CVE-2026-04944.3Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would CVE-2026-04955.1SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which CVE-2026-04966.6SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) witho CVE-2026-04974.3SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This CVE-2026-04987.2SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module expose CVE-2026-04996.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-05008.8Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker co