CVE-2026-0488
critical · 9.9An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
9.9
CVSS
0.5%
EPSS (exploit prob.)
42nd
EPSS percentile
2026-02-10
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-862
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sap | netweaver_application_server_abap | 700 |
| sap | s/4hana | 102 |
| sap | s/4hana | 103 |
| sap | s/4hana | 104 |
| sap | s/4hana | 105 |
| sap | s/4hana | 106 |
| sap | s/4hana | 107 |
| sap | s/4hana | 108 |
| sap | s/4hana | 109 |
| sap | webclient_ui_framework | 700 |
| sap | webclient_ui_framework | 701 |
| sap | webclient_ui_framework | 730 |
| sap | webclient_ui_framework | 731 |
| sap | webclient_ui_framework | 746 |
| sap | webclient_ui_framework | 747 |
| sap | webclient_ui_framework | 748 |
| sap | webclient_ui_framework | 800 |
| sap | webclient_ui_framework | 801 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-0488