CVE Intelligence
Analysis AI-assisted

CVE-2026-0488: Code Injection in SAP CRM and SAP S/4HANA (Scripting Editor)

SAP has disclosed CVE-2026-0488, a critical code injection issue in SAP CRM and SAP S/4HANA (Scripting Editor) with a CVSS base score of 9.9 as recorded. The record describes an authenticated attacker able to run unauthorized functionality, including arbitrary SQL statements. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

SAP has published CVE-2026-0488, a code injection issue in SAP CRM and SAP S/4HANA (Scripting Editor). The record classifies it under CWE-862 (Missing Authorization) and describes an authenticated attacker abusing a flaw in a generic function module call.

Impact

  • According to the record, the flaw allows execution of unauthorized critical functionality, including arbitrary SQL statements.
  • The record states high impact on confidentiality, integrity and availability, with possible full database compromise.
  • The recorded base score is 9.9 (critical), as reported by NVD and SAP.

Affected products and versions

  • SAP CRM and SAP S/4HANA (Scripting Editor): the record lists several release lines, including 107, 108, 109, 800 and 801.
  • SAP S/4HANA: release lines 102 through 109 are listed.
  • SAP NetWeaver Application Server ABAP: release line 700.
  • SAP Webclient UI Framework: release lines from 700 up to and including 801, as listed in the record.
  • The record contains no fixed-version list. Consult SAP Note 3697099 for the applicable correction.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • SSVC exploitation is recorded as none and automatable as no.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the SAP Security Patch Day information and SAP Note 3697099, then apply the correction for each affected release.
  • Restrict authorizations that allow use of the Scripting Editor and related function module calls to the smallest necessary set of users.
  • Prioritize systems where many users hold broad authorizations.

Detection guidance

  • Review audit logs for unusual use of the Scripting Editor and unexpected database-level activity.
  • Monitor changes to role and authorization assignments in SAP systems.

Limitations of the available information

  • The record has no fixed-version data, so the absence of a listed fix does not mean no fix exists.
  • Technical details of the vulnerable function module are not provided, and this analysis does not include them.
  • Exploitation likelihood is low in the EPSS data, but this does not replace the vendor's risk assessment.

Frequently asked questions

Is CVE-2026-0488 being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which SAP products are affected?

The record lists SAP CRM and SAP S/4HANA with the Scripting Editor, along with SAP NetWeaver Application Server ABAP and SAP Webclient UI Framework in the affected product list.

What should administrators do first?

Review SAP Note 3697099 and the SAP Security Patch Day information, apply the correction for each affected release, and limit authorizations for the Scripting Editor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.