Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-0488: An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic func

46
This month
CRITICAL 9.9DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2026-0488 is a critical-severity flaw (CVSS 9.9) affecting netweaver application server abap, s\/4hana, webclient ui framework. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Why this priority

  • Critical severity

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score9.9 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.5% (top 55%)
CISA exploited listNo
WeaknessCWE-862
Published2026-02-10
Last modified2026-06-17
Publisher (CNA): SAP SE · Vendor: sap

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

sap netweaver application server abap DOWNGRADE
Affected: 700
Fixed in: no fixed release known
Safe to downgrade to: a release before 700
1. Check installed version
apt-cache policy netweaver-application-server-abap || rpm -q netweaver-application-server-abap || netweaver-application-server-abap --version
2. No fixed release: DOWNGRADE to a release before 700 (Debian / Ubuntu)
apt-cache madison netweaver-application-server-abap sudo apt install netweaver-application-server-abap=<VERSION_BEFORE_700> sudo apt-mark hold netweaver-application-server-abap
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list netweaver-application-server-abap sudo dnf downgrade netweaver-application-server-abap-<VERSION_BEFORE_700> sudo dnf versionlock add netweaver-application-server-abap
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
sap s\/4hana DOWNGRADE
Affected: 102 · 103 · 104 · 105 · 106 · 107 · 108 · 109
Fixed in: no fixed release known
Safe to downgrade to: a release before 102
1. Check installed version
apt-cache policy s4hana || rpm -q s4hana || s4hana --version
2. No fixed release: DOWNGRADE to a release before 102 (Debian / Ubuntu)
apt-cache madison s4hana sudo apt install s4hana=<VERSION_BEFORE_102> sudo apt-mark hold s4hana
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list s4hana sudo dnf downgrade s4hana-<VERSION_BEFORE_102> sudo dnf versionlock add s4hana
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
sap webclient ui framework DOWNGRADE
Affected: 700 · 701 · 730 · 731 · 746 · 747 · 748 · 800
Fixed in: no fixed release known
Safe to downgrade to: a release before 700
1. Check installed version
apt-cache policy webclient-ui-framework || rpm -q webclient-ui-framework || webclient-ui-framework --version
2. No fixed release: DOWNGRADE to a release before 700 (Debian / Ubuntu)
apt-cache madison webclient-ui-framework sudo apt install webclient-ui-framework=<VERSION_BEFORE_700> sudo apt-mark hold webclient-ui-framework
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list webclient-ui-framework sudo dnf downgrade webclient-ui-framework-<VERSION_BEFORE_700> sudo dnf versionlock add webclient-ui-framework
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-0488?

netweaver application server abap: downgrade or apply the listed mitigation; s\/4hana: downgrade or apply the listed mitigation; webclient ui framework: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-0488 being exploited?

CVE-2026-0488 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-0488 affect?

CVE-2026-0488 affects netweaver application server abap, s\/4hana, webclient ui framework. Severity is critical (CVSS 9.9). An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL stateme

How urgent is CVE-2026-0488?

Priority 46/100. Critical severity

Software pages

SAP vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.