CVE-2026-0501

CRITICAL EPSS 33.1%

Published Jan 13, 20265mo ago · Modified Jun 17, 20261w ago

9.9 CVSS 3.1

Critical

Published Jan 13, 2026 5mo ago

Last Modified Jun 17, 2026 1w ago

Description

Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application.

CVSS Details

Base Score

9.9

Exploitability

3.1

Impact

6.0

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

33.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

References 2

me.sap.com https://me.sap.com/notes/3687749
url.sap https://url.sap/sapsecuritypatchday

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.