Ejecución remota de código en SAP Wily Introscope Enterprise Manager (WorkStation)

The impact of CVE-2026-0500 is severe. A successful exploit allows an attacker to gain complete control over the affected system. This includes the ability to read, modify, and delete sensitive data, install malware, and potentially pivot to other systems within the network. The attack vector involves crafting a malicious JNLP file and hosting it on a publicly accessible URL. When a user clicks on this URL, the Wily Introscope Server executes the attacker's commands, leading to full system compromise. This resembles previous JNLP-based exploitation techniques, highlighting the potential for widespread impact if unpatched systems remain exposed.

Organizations utilizing SAP Wily Introscope Enterprise Manager (WorkStation) version 10.8, particularly those with publicly accessible instances or those lacking robust network segmentation, are at significant risk. Shared hosting environments where multiple users share the same Wily Introscope Server are also particularly vulnerable.

• linux / server: Monitor system logs (journalctl) for unusual Java process activity or attempts to execute commands via JNLP.

journalctl -u java -g 'JNLP'

• generic web: Use curl to check for publicly accessible JNLP files.

curl -I https://<your_wily_server>/<potential_jnlp_path>.jnlp

• sap: Review SAP security audit logs for suspicious activity related to the Wily Introscope Server.

1. 2026-01-13Disclosure

   disclosure

1. Reservado2025-12-09
2. Publicada2026-01-13
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-0500 is to immediately upgrade SAP Wily Introscope Enterprise Manager (WorkStation) to version 10.8.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the Wily Introscope Server through a Web Application Firewall (WAF) or proxy, blocking access to potentially malicious JNLP files. Monitor network traffic for suspicious JNLP file downloads and execution attempts. Review and restrict user permissions to minimize the potential impact of a successful exploit.