CVE-2026-0488 is a critical (CVSS 9.9) missing authorization flaw in the Scripting Editor of SAP CRM and SAP S/4HANA. An authenticated attacker can call a generic function module and run arbitrary SQL, which risks the full database. Apply SAP Security Note 3697099 from the February 2026 Patch Day.
What's affected
The record lists SAP NetWeaver Application Server ABAP, SAP S/4HANA and the SAP WebClient UI Framework, in the context of SAP CRM and S/4HANA. It does not list version ranges. SAP publishes those in the security note, which needs an SAP customer login. The note page could not be read without one, so verify affected components there.
How to check if you're exposed
- Sign in to the SAP for Me portal and open Security Note 3697099.
- Compare the listed software components and support packages with your systems, using the SAP Note Assistant or your usual transport process.
- Check which users hold authorisations for the scripting editor and for calling function modules.
What to do now
- Read SAP Security Note 3697099 and the Patch Day overview at url.sap/sapsecuritypatchday.
- Apply the correction in development first, then test and transport it to production.
- Review authorisations that allow use of the Scripting Editor and generic function module calls, and remove broad grants.
- Review database and application logs for unexpected SQL activity from application users.
- Track later notes that update this one.
SAP security notes are applied through the usual change process, and the order matters. Apply the correction in a development system, test the scripting editor and the CRM or S/4HANA processes that touch it, then transport the change to quality and production. Keep the note number in the change record so audits can follow it.
Authorisations are the second control. The flaw is a missing check, so a wide grant on the scripting editor and on function module calls is what makes it reachable by an ordinary user. Use your authorisation tools to list who holds those rights, and compare the list with who needs them.
Database auditing helps with detection. If your database logs statements by application user, look for SQL that does not match normal application behaviour since the Patch Day.
Why it matters
The weakness is CWE-862 (missing authorization). A function module can be called through the editor without checking that the caller may perform the action it triggers. The effect is a user who is allowed to log in but not to run SQL being able to do so anyway, which gives control of the database. The scope is changed in the vector.
The attacker needs a login in this case, so the bug matters most where many users hold accounts. The record does not mark it as exploited, and it is not in the CISA KEV list.
Missing authorization is one of the most common flaws in business applications, and the cost is high where an application sits on top of a database that holds everything. The scripting editor is a power tool, and power tools need checks on what they may call.
For SAP teams the practical habit is to apply Patch Day notes monthly and to review who holds powerful authorisations each quarter. The two together keep both the code and the grants current.
Try it yourself
Patch Day notes pile up quickly. A single view of open items by severity helps decide what is applied first.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
Yes. The record describes an authenticated attacker, with low privileges in the vector.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Referenced by the CVE record (not independently fetched for this guide):
Last reviewed: 19 October 2026.
