9.9Crítica
CVE-2026-0488Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
Descripción
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
Debilidad (CWE):
CWE-862
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| sap | netweaver application server abap | 700 | |
| sap | s/4hana | 102 | |
| sap | webclient ui framework | 700 | |
| SAP_SE | SAP CRM and SAP S/4HANA (Scripting Editor) | S4FND 102, 103, 104, 105, 106, 107, 108, 109, SAP_ABA 700, WEBCUIF 700, 701, 730, 731, 746, 747, 748, 800, 801 |
Referencias y parches
- https://me.sap.com/notes/3697099
- https://url.sap/sapsecuritypatchday Vendor Advisory
Coincidencias CPE (NVD) (18)
cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:*cpe:2.3:a:sap:s\/4hana:109:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:700:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:701:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:730:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:731:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:746:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:747:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:748:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:800:*:*:*:*:*:*:*cpe:2.3:a:sap:webclient_ui_framework:801:*:*:*:*:*:*:*