Not scored
CVE-2026-0488
Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
SAP_SESAP CRM and SAP S/4HANA (Scripting Editor)
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 45% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 10 Feb · 09:25 UTC | SecurityOnline | Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA Databases |
| Wed 11 Feb · 14:55 UTC | The Hacker News | Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms |
- Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network PlatformsThe Hacker News
- Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA DatabasesSecurityOnline · first in our coverage