CVE-2026-0504 json
Insufficient Input Handling in JNDI Operations of SAP Identity Management
published 2026-01-13 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-2377
- cvss
- 3.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N |
Affected products
- SAP_SE SAP Identity Management
Classification
- Weakness
-
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
References
Sources
- CVE List CVE-2026-0504
- NVD CVE-2026-0504
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.