CVE-2026-0488 — Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)

Description (CNA)

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP CRM and SAP S/4HANA (Scripting Editor)	affected S4FND 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected 109; affected SAP_ABA 700; affected WEBCUIF 700; affected 701; affected 730; affected 731; affected 746; affected 747; affected 748; affected 800; affected 801

CWE

CWE-862

References

https://me.sap.com/notes/3697099
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.