CVE-2026-0498: SAP s/4 Hana

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected products

• SAP s/4 Hana: version 102 only; version 103 only; version 104 only; version 105 only; version 106 only; version 107 only; …

Published 2026-01-13. Last modified 2026-06-17.