VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Jan 13, 2026· Updated Jun 17, 2026

CVE-2026-0498

CVE-2026-0498

Description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • SAP/S\/4hana9 versions
    cpe:2.3:a:sap:s\/4_hana:102:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:sap:s\/4_hana:102:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:103:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:104:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:105:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:106:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:107:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:108:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s\/4_hana:109:*:*:*:*:*:*:*
    • (no CPE)
  • SAP/S/4HANA Cloud Private Edition or on Premisecpe-rescue
    Range: S4CORE 102

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.