CVE-2026-0488
Published: 10 February 2026
Summary
CVE-2026-0488 is a critical-severity Missing Authorization (CWE-862) vulnerability in Sap Webclient Ui Framework. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the vulnerability by applying SAP-provided patches from security note 3697099 to fix the flawed generic function module call.
Validates inputs to the Scripting Editor and function module to block arbitrary SQL statement execution and prevent database compromise.
Enforces approved authorizations for access to critical functionalities in the generic function module, addressing the CWE-862 missing authorization flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in network-accessible Scripting Editor enables authenticated low-priv attacker to run arbitrary SQL, directly mapping to public app exploitation and priv esc to full DB control.
NVD Description
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a…
more
full database compromise with high impact on confidentiality, integrity, and availability.
Deeper analysisAI
CVE-2026-0488 is a critical vulnerability affecting the Scripting Editor in SAP CRM and SAP S/4HANA. It arises from a flaw in a generic function module call (CWE-862) that enables an authenticated attacker to execute unauthorized critical functionalities, including arbitrary SQL statements. This vulnerability leads to full database compromise, with severe impacts on confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
An attacker requires only low-privilege authenticated access to exploit this issue over the network, with low attack complexity and no user interaction needed. Exploitation occurs through the Scripting Editor, allowing the execution of arbitrary SQL statements that grant complete control over the database, enabling data exfiltration, tampering, deletion, or other destructive actions.
SAP advisories provide mitigation details in security note 3697099 (https://me.sap.com/notes/3697099) and as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday), where patches and implementation guidance are available for affected systems.
Details
- CWE(s)