Remote Code Execution Vulnerability in SAP Wily Introscope Enterprise Manager
CVE-2026-0500

9.6CRITICAL

Key Information:

Vendor

SAP
Status
SAP Wily Introscope Enterprise Manager (workstation)
Vendor
CVE Published:
13 January 2026

What is CVE-2026-0500?

A security weakness exists in SAP Wily Introscope Enterprise Manager due to the use of a vulnerable third-party component. This vulnerability allows unauthenticated attackers to craft malicious JNLP files, which can be accessed via public URLs. If a victim interacts with the malicious URL, the Wily Introscope Server may execute arbitrary OS commands on the victim's system, leading to serious risks regarding the confidentiality, integrity, and availability of the system.

Affected Version(s)

SAP Wily Introscope Enterprise Manager (WorkStation) WILY_INTRO_ENTERPRISE 10.8

References

https://me.sap.com/notes/3668679
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.