PT-2026-7203 · Sap · Sap S/4Hana+1

Published

2026-02-09

·

Updated

2026-02-15

·

CVE-2026-0488

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SAP CRM and SAP S/4HANA (affected versions not specified)
Description An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) can exploit a flaw in a generic function module call and execute unauthorized critical functionalities. This includes the ability to execute an arbitrary SQL statement, potentially leading to a full database compromise with a high impact on confidentiality, integrity, and availability. The issue stems from deficiencies in the authorization procedure. The vulnerability allows an attacker to send a specially crafted SQL query to gain unauthorized access to the database. The vulnerable component is a generic function module.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-01625
CVE-2026-0488

Affected Products

Sap Crm
Sap S/4Hana