critical9.9
CVE-2026-0488
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critica…
Impact
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Netweaver Application Server Abap | Version 700 |
| Sap | S\/4hana | Versions 102, 103, 104, 105, 106, 107 |
| Sap | Webclient Ui Framework | Versions 700, 701, 730, 731, 746, 747 |