Critical severity9.9NVD Advisory· Published Feb 10, 2026· Updated Jun 17, 2026
CVE-2026-0488
CVE-2026-0488
Description
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
21- cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:*
- cpe:2.3:a:sap:s\/4hana:109:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:700:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:sap:webclient_ui_framework:700:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:701:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:730:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:731:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:746:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:747:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:748:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:800:*:*:*:*:*:*:*
- cpe:2.3:a:sap:webclient_ui_framework:801:*:*:*:*:*:*:*
- SAP_SE/SAP CRM and SAP S/4HANA (Scripting Editor)v5Range: S4FND 102
Patches
Vulnerability mechanics
References
2- url.sap/sapsecuritypatchdaynvdVendor Advisory
- me.sap.com/notes/3697099nvdPermissions Required
News mentions
0No linked articles in our index yet.