CVE-2026-0500
Published: 13 January 2026
Summary
CVE-2026-0500 is a critical-severity Code Injection (CWE-94) vulnerability in Sap Introscope Enterprise Manager. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 26.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-18 (Mobile Code) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0500, published on 2026-01-13, stems from the use of a vulnerable third-party component in SAP Wily Introscope Enterprise Manager (WorkStation). This flaw, tied to CWE-94 (code injection), carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It allows the creation of a malicious Java Network Launch Protocol (JNLP) file that can be hosted at a public-facing URL.
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low complexity (AC:L) by tricking a victim into clicking the malicious URL, which requires user interaction (UI:R). Upon access, the targeted Wily Introscope Server executes arbitrary OS commands on the victim's machine, achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) while changing scope (S:C) for full system compromise.
SAP advisories provide mitigation details, including patches referenced in SAP Note 3668679 (https://me.sap.com/notes/3668679) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2387
Vulnerability details
Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on…
more
the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a code injection (CWE-94) in SAP Wily Introscope Workstation exploited via a malicious JNLP file from a public URL, requiring user interaction to launch, enabling client-side exploitation for arbitrary OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the vulnerability in the third-party component of SAP Wily Introscope by requiring identification, reporting, and patching as specified in SAP Note 3668679.
Restricts execution of mobile code such as malicious JNLP files from untrusted public URLs by prohibiting use from untrusted sources and validating prior to execution.
Deploys malicious code protection mechanisms like antivirus to scan, detect, and prevent execution of the malicious JNLP exploiting the vulnerable component.