CVE-2026-0500

Critical

Published: 13/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Vulnerability in SAP Wily Introscope Enterprise Manager (WorkStation) due to a vulnerable third-party component. An unauthenticated attacker can create a malicious JNLP file accessible via a public URL, and a victim clicking it could lead to OS command execution on the victim's machine.

Risk Assessment

An attacker can fully compromise the victim's system, undermining confidentiality, integrity, and availability.

Recommendation

Apply patches provided by SAP for Wily Introscope and restrict access to public URLs.

Original NVD description (English source)

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.