CVE-2026-0500
Published: 13 January 2026
Description
Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on…
more
the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the vulnerability in the third-party component of SAP Wily Introscope by requiring identification, reporting, and patching as specified in SAP Note 3668679.
Restricts execution of mobile code such as malicious JNLP files from untrusted public URLs by prohibiting use from untrusted sources and validating prior to execution.
Deploys malicious code protection mechanisms like antivirus to scan, detect, and prevent execution of the malicious JNLP exploiting the vulnerable component.
Security SummaryAI
CVE-2026-0500, published on 2026-01-13, stems from the use of a vulnerable third-party component in SAP Wily Introscope Enterprise Manager (WorkStation). This flaw, tied to CWE-94 (code injection), carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It allows the creation of a malicious Java Network Launch Protocol (JNLP) file that can be hosted at a public-facing URL.
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low complexity (AC:L) by tricking a victim into clicking the malicious URL, which requires user interaction (UI:R). Upon access, the targeted Wily Introscope Server executes arbitrary OS commands on the victim's machine, achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) while changing scope (S:C) for full system compromise.
SAP advisories provide mitigation details, including patches referenced in SAP Note 3668679 (https://me.sap.com/notes/3668679) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a code injection (CWE-94) in SAP Wily Introscope Workstation exploited via a malicious JNLP file from a public URL, requiring user interaction to launch, enabling client-side exploitation for arbitrary OS command execution.