Critical SAP Alert: S/4HANA SQL Injection & Wily RCE Threaten Financial Data

According to SAP, on January 13, 2026 the enterprise software giant released 17 new security notes addressing vulnerabilities that could expose critical financial data and allow for full system compromise, with the update focusing on fresh threats rather than previously issued notes.

Leading the pack is a near-maximum severity SQL Injection vulnerability in SAP S/4HANA, CVE-2026-0501, which affects the Financials – General Ledger component and has a CVSS score of 9.9; an authenticated user could read, modify or delete backend database data due to insufficient input validation.

The same bulletin also notes CVE-2026-0500, a critical Remote Code Execution flaw in SAP Wily Introscope Enterprise Manager, where an unauthenticated attacker can exploit a vulnerable JNLP file to cause the Wily Server to execute OS commands. Additional patched issues include two high‑impact Code Injection vulnerabilities (CVE-2026-0498 and CVE-2026-0491) that allow injection of ABAP code or OS commands via RFC modules by admin users. The advisory urges immediate application of these notes to mitigate the risk of full system compromise.