What is the CVSS score of CVE-2026-0501?

CVE-2026-0501 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SAP are affected by CVE-2026-0501?

CVE-2026-0501 presents critical security risk, a SQL injection vulnerability rated CVSS 9.9.

How to fix or mitigate CVE-2026-0501?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

SAP CVE-2026-0501

CRITICAL

SQL Injection (CWE-89)

2026-01-13 cna@sap.com

SAP

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 02:15 nvd

CRITICAL 9.9

DescriptionCVE.org

Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application.

AnalysisAI

SAP S/4HANA General Ledger (Private Cloud and On-Premise) has SQL injection allowing authenticated users to read, modify, and delete backend database data with scope change (CVSS 9.9). Financial data is directly at risk.

Technical ContextAI

Insufficient input validation in the Financials General Ledger module (CWE-89) allows authenticated users to craft SQL queries that bypass the SAP authorization model. The scope change means the attacker can access data beyond their authorized scope.