CVE-2026-0500

critical · 9.6

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.

9.6

CVSS

0.4%

EPSS (exploit prob.)

35th

EPSS percentile

2026-01-13

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
sap	introscope_enterprise_manager	10.8

Check a specific version with /api/v1/cve/match.

References

https://me.sap.com/notes/3668679
https://url.sap/sapsecuritypatchday

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-0500