PT-2026-2336 · Sap · Sap Wily Introscope Workstation+1

Published 2026-01-13 · Updated 2026-02-10 · CVE-2026-0500

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Wily Introscope Enterprise Manager (WorkStation) (affected versions not specified)

Description An unauthenticated attacker can create a malicious Java Network Launch Protocol (JNLP) file accessible via a public URL. When a victim clicks this URL, the accessed SAP Wily Introscope Server could execute operating system commands on the victim’s machine, potentially compromising the confidentiality, integrity, and availability of the system. The issue stems from the use of a vulnerable third-party component. A JNLP file is a file format used by Java Web Start to launch applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-00343

CVE-2026-0500

Affected Products

Sap Wily Introscope Enterprise Manager

Sap Wily Introscope Workstation

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-0500 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0500 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00343 · Security Note
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://twitter.com/ThreatSynop/status/2011059224604733529 · Twitter Post
• https://twitter.com/ThreatSynop/status/2011079086404219001 · Twitter Post
• https://me.sap.com/notes/3668679 · Note
• https://reddit.com/r/Action1/comments/1r18ofk/february_patch_tuesday_overview · Reddit Post
• https://twitter.com/CVEnew/status/2010911103006470257 · Twitter Post
• https://twitter.com/CveFindCom/status/2010904465193242645 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html · Note
• https://twitter.com/ThreatSynop/status/2011036693520908646 · Twitter Post
• https://twitter.com/eyalestrin/status/2011388623879581964 · Twitter Post
• https://twitter.com/0dayPublishing/status/2011089873759809865 · Twitter Post
• https://twitter.com/DavidMarquet19/status/2020769785152196822 · Twitter Post