SAP Critical RCE and Auth Bypass Vulnerabilities

SAP has released 26 new Security Notes addressing multiple vulnerabilities across SAP CRM, SAP S/4HANA, SAP NetWeaver (ABAP and Java), SAP BusinessObjects, SAP Commerce Cloud, and SAP Supply Chain Management. Several vulnerabilities are rated Critical and High, with CVSS scores reaching 9.9.

The most severe issue (CVE-2026-0488) enables code injection in SAP CRM and SAP S/4HANA (Scripting Editor), allowing execution of arbitrary SQL statements and potentially resulting in full database compromise. Additional high-impact vulnerabilities include missing authorization checks in SAP NetWeaver and ABAP platforms, XML signature wrapping, and multiple denial-of-service conditions.

CVE
Primary critical vulnerabilities include:
CVE-2026-0488 (Code Injection – CVSS 9.9)
CVE-2026-0509 (Missing Authorization – CVSS 9.6)
CVE-2026-23687 (XML Signature Wrapping – CVSS 8.8)

Multiple additional medium and low-severity vulnerabilities were addressed as part of this patch cycle.

Targeting / Delivery Mechanism
Most high-severity issues require authenticated access, often with low privileges. Some denial-of-service and redirection issues may be exploitable without authentication. Risk increases where SAP application servers or administrative interfaces are externally exposed.

Execution Technique
Exploitation techniques include code injection via generic function module calls, missing authorization checks enabling privilege escalation, crafted XML manipulation, and malformed requests that disrupt services.

Persistence / Deployment
Successful exploitation may allow attackers to execute arbitrary SQL, escalate privileges, manipulate system data, impersonate users, or establish persistent administrative access within SAP environments.