CVE-2026-0500 Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)

Critical 9.6 Published 13 Jan 2026 Updated 13 Jan 2026

An attacker can execute OS commands on a victim's machine by tricking them into opening a malicious JNLP file served by the Wily Introscope server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-0500?

CVE-2026-0500 is a critical code injection vulnerability in SAP_SE SAP Wily Introscope Enterprise Manager (WorkStation), published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.

Weakness: CWE-94

Which versions are affected by CVE-2026-0500?

It affects 1 product.

Products include Sap Introscope Enterprise Manager.

How do I fix CVE-2026-0500?

No fix has been published for CVE-2026-0500 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-0500 being exploited?

There is no known exploitation of CVE-2026-0500 in the wild and no public exploit code.

CVE-2020-6364 Command injection in SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager) Critical 10.0

Sources

Also known as GHSA-9m57-5mv3-fjx3.