CVE-2026-0501 — SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)

CVE-2026-0501

SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger) PUBLISHED

Description (CNA)

Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)	affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected 109

CWE

CWE-89

References

https://me.sap.com/notes/3687749
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.