CVE-2026-0498

moderate-risk
Published 2026-01-13

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Do I need to act?

-
0.07% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (8)

S\/4 Hana
S\/4 Hana
S\/4 Hana
S\/4 Hana
S\/4 Hana
S\/4 Hana
S\/4 Hana
S\/4 Hana

Affected Vendors

Sap

References (2)

Permissions Required https://me.sap.com/notes/3694242
Patch https://url.sap/sapsecuritypatchday
45
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 0/34 · Minimal
Exposure 14/34 · Moderate