CVE-2026-0498

CriticalRCE

Published: 13 January 2026

Published

13 January 2026

Modified

22 January 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0007 20.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0498 is a critical-severity Code Injection (CWE-94) vulnerability in Sap S\/4 Hana. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 20.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other AI Platforms.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Command and Scripting Interpreter (T1059) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the code injection vulnerability by requiring timely application of vendor patches like SAP security note 3694242 to fix the flawed RFC function module.

SI-10 Information Input Validation good match

prevent

Prevents arbitrary ABAP code or OS command injection by enforcing validation of inputs to the exposed RFC function module.

AC-3 Access Enforcement partial match

prevent

Enforces authorization checks that the vulnerability bypasses, limiting exploitation even by admin-privileged attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

CVE enables arbitrary ABAP/OS command injection via exposed RFC (remote code execution) with bypassed auth checks, directly mapping to command/scripting interpreter execution and exploitation of remote services.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks.…

This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Deeper analysisAI

CVE-2026-0498 is a critical vulnerability in SAP S/4HANA Private Cloud and On-Premise editions, affecting a function module exposed via RFC. Published on January 13, 2026, it allows an attacker with admin privileges to inject arbitrary ABAP code or OS commands, bypassing essential authorization checks. Classified under CWE-94 (Code Injection) with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), the flaw acts as a backdoor, potentially leading to complete system compromise and undermining confidentiality, integrity, and availability.

An attacker requires high-privilege admin access to exploit this vulnerability over the network with low complexity and no user interaction. By targeting the exposed RFC function module, they can execute arbitrary ABAP code or OS commands, evading standard authorization mechanisms. Successful exploitation grants full control over the SAP system, enabling data exfiltration, modification, or disruption across the affected environment.

SAP advisories address this issue via security note 3694242, available at https://me.sap.com/notes/3694242, and as part of the SAP Security Patch Day at https://url.sap/sapsecuritypatchday. Administrators should apply the recommended patches to mitigate the risk of exploitation.