What is the CVSS score of CVE-2026-0500?

CVE-2026-0500 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Java are affected by CVE-2026-0500?

CVE-2026-0500 presents critical security risk, a code injection vulnerability rated CVSS 9.6.. A patch is available.

How to fix or mitigate CVE-2026-0500?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Java CVE-2026-0500

CRITICAL

Code Injection (CWE-94)

2026-01-13 cna@sap.com

SAP Java Command Injection Introscope Enterprise Manager

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 22, 2026 - 18:47 nvd

Patch available

CVE Published

Jan 13, 2026 - 02:15 nvd

CRITICAL 9.6

DescriptionCVE.org

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.

AnalysisAI

SAP Wily Introscope Enterprise Manager uses a vulnerable third-party component that allows unauthenticated attackers to create malicious JNLP files at public URLs. Victims who click these URLs execute OS commands on their machines. Scope change. Patch available.

Technical ContextAI

A vulnerable third-party component allows unauthenticated creation of JNLP files (CWE-94). Java Web Start processes these files, executing the specified commands on the victim's machine with their user privileges. The scope change reflects code execution on the victim's machine, not the server.