CVE-2026-0498 Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)

What is CVE-2026-0498?

CVE-2026-0498 is a critical code injection vulnerability in SAP_SE SAP S/4HANA (Private Cloud and On-Premise), published on 13 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Weakness: CWE-94

Which versions are affected by CVE-2026-0498?

It affects 1 product.

Products include Sap S\/4 Hana.

How do I fix CVE-2026-0498?

No fix has been published for CVE-2026-0498 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-0498 being exploited?

There is no known exploitation of CVE-2026-0498 in the wild and no public exploit code.

Other vulnerabilities in SAP_SE SAP S/4HANA (Private Cloud and On-Premise)

• CVE-2024-34691 Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) Medium 6.5
• CVE-2024-45282 HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements) Medium 4.3
• CVE-2023-41369 External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application) Low 3.5
• CVE-2023-41368 Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps) Low 2.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4p53-w5pc-f48w.