CVE-2026-0488

sap netweaver application server abap, sap s/4hana, sap webclient ui framework

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-0488

Katalog CVE

CVSS 9.9 · Critical EPSS 0,54%

Kerentanan Missing Authorization pada sap netweaver application server abap, sap s/4hana +1 lainnya. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Rincian

Terbit di NVD
10 Februari 2026
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-862: Missing Authorization
EPSS (30 hari)
0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
sap netweaver application server abap Versi 700
sap s/4hana Versi 102
sap s/4hana Versi 103
sap s/4hana Versi 104
sap s/4hana Versi 105
sap s/4hana Versi 106
sap s/4hana Versi 107
sap s/4hana Versi 108
sap s/4hana Versi 109
sap webclient ui framework Versi 700
sap webclient ui framework Versi 701
sap webclient ui framework Versi 730
sap webclient ui framework Versi 731
sap webclient ui framework Versi 746
sap webclient ui framework Versi 747
sap webclient ui framework Versi 748
sap webclient ui framework Versi 800
sap webclient ui framework Versi 801

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.