CVE-2026-0491 — AI Deep Analysis Summary

🚨 **Essence**: SAP Landscape Transformation (LTX) suffers from a **Code Injection** flaw. Attackers inject arbitrary **ABAP code** or **OS commands** via exposed RFC functions.…

🛡️ **Root Cause**: **CWE-94** (Code Injection). The vulnerability stems from improper validation of inputs in **RFC-exposed function modules**, allowing malicious code execution instead of safe data processing.

🏢 **Affected**: **SAP Landscape Transformation** by **SAP SE** (Germany). Specifically, versions where **RFC interfaces** are exposed and vulnerable to injection are at risk.…

💀 **Attacker Capabilities**: Can execute **arbitrary ABAP code** or **OS commands**.…

🔒 **Exploitation Threshold**: **Medium-High**. Requires **PR:H** (Privileges Required: High). The attacker needs **valid authentication** to access the exposed RFC functions.…

📦 **Public Exploit**: **No**. The `pocs` field is empty. No public Proof-of-Concept (PoC) or wild exploitation code is currently available based on the provided data.

🔍 **Self-Check**: Scan for exposed **RFC function modules** in SAP Landscape Transformation. Verify if any modules allow input parameters that could be interpreted as code. Check SAP Security Patch Day updates.

🩹 **Official Fix**: **Yes**. SAP has released guidance. Refer to **SAP Note 3697979** and the **SAP Security Patch Day** for the official patch or mitigation steps. Apply updates immediately.

🚧 **No Patch Workaround**: If patching is delayed, **disable or restrict access** to the vulnerable RFC function modules. Implement strict **network segmentation** and ensure only trusted IPs can access these interfaces.

⚡ **Urgency**: **High Priority**. CVSS Score indicates **Critical** impact (S:C, C:H, I:H, A:H). Even though auth is required, the ability to run OS commands makes this a **critical risk**. Patch ASAP upon release.