Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)

The impact of CVE-2026-0498 is severe. Successful exploitation allows an attacker to execute arbitrary code on the SAP S/4HANA server with administrative privileges. This grants them complete control over the system, enabling them to steal sensitive data (customer information, financial records, intellectual property), modify data, disrupt operations, and potentially pivot to other systems within the network. The RFC-based injection bypasses standard authorization checks, making exploitation relatively straightforward for attackers with sufficient access. This vulnerability shares similarities with other RFC injection flaws, where improper input validation allows attackers to execute malicious code within the SAP environment.

Organizations running SAP S/4HANA version 102, particularly those with extensive use of RFC connections and limited network segmentation, are at significant risk. Shared hosting environments utilizing SAP S/4HANA are also vulnerable, as a compromise of one tenant could potentially impact others. Legacy SAP S/4HANA configurations with weak access controls are especially susceptible.

• linux / server:

journalctl -u saprouter | grep -i "rfc injection"

• generic web:

curl -I <rfc_endpoint_url>

• database (mysql):

SELECT * FROM sap.rfc_connections WHERE connection_string LIKE '%vulnerable_function_module%';

1. 2026-01-13Disclosure

   disclosure

1. Reserviert2025-12-09
2. Veröffentlicht2026-01-13
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-0498 is to upgrade to a patched version of SAP S/4HANA. SAP has not yet released a fixed version as of the publication date. Until a patch is available, consider implementing temporary workarounds. Restrict access to the vulnerable RFC function module, limiting which users and systems can access it. Implement strict input validation on all data passed to the function module to prevent malicious code injection. Monitor RFC connections for suspicious activity and unusual command executions. Consider using a Web Application Firewall (WAF) to filter malicious requests targeting the RFC endpoint. After upgrading, confirm the vulnerability is resolved by attempting to trigger the injection scenario with a benign payload and verifying that it is blocked.