CVE-2026-0491: SAP Landscape Transformation RCE Vulnerability

CVE-2026-0491 Overview

SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Critical Impact

This code injection vulnerability allows attackers with administrative privileges to execute arbitrary ABAP code or OS commands, effectively functioning as a backdoor that can lead to full system compromise.

Affected Products

• SAP Landscape Transformation (SLT)
• SAP Systems with RFC-enabled function modules
• SAP NetWeaver Application Server (ABAP stack)

Discovery Timeline

• January 13, 2026 - CVE-2026-0491 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0491

Vulnerability Analysis

This vulnerability in SAP Landscape Transformation represents a severe code injection flaw (CWE-94) that allows privileged attackers to bypass authorization checks and execute arbitrary code. The affected function module exposed via Remote Function Call (RFC) fails to properly validate and sanitize input before processing, enabling the injection of malicious ABAP code or operating system commands.

While exploitation requires administrative privileges, the impact is catastrophic. An attacker successfully exploiting this vulnerability gains the ability to execute arbitrary commands within the SAP environment, effectively creating a persistent backdoor. This undermines all three pillars of information security: confidentiality through unauthorized data access, integrity through potential data manipulation, and availability through system disruption capabilities.

The network-accessible nature of the RFC interface means that attackers can exploit this vulnerability remotely, and the scope change indicates that compromise of the vulnerable component can impact resources beyond its security scope.

Root Cause

The root cause of CVE-2026-0491 is inadequate input validation and missing authorization checks in the RFC-exposed function module within SAP Landscape Transformation. The function module fails to properly sanitize user-supplied input before executing code, allowing an attacker to inject and execute arbitrary ABAP statements or OS-level commands. This constitutes a classic code injection vulnerability where trust boundaries are not properly enforced despite the administrative privilege requirement.

Attack Vector

The attack vector for this vulnerability involves a network-based approach where an authenticated attacker with administrative privileges connects to the vulnerable SAP system via RFC. The attacker crafts malicious input containing ABAP code or OS commands and submits it to the vulnerable function module. Due to the missing authorization checks and inadequate input validation, the injected code is executed in the context of the SAP system, potentially with elevated privileges.

The exploitation requires no user interaction and has low attack complexity, making it particularly dangerous in environments where administrative access may have been compromised or where insider threats exist.

Detection Methods for CVE-2026-0491

Indicators of Compromise

• Unexpected ABAP program executions or dynamic code evaluation in SAP Landscape Transformation modules
• Unusual RFC connection patterns targeting SLT function modules from unauthorized sources
• OS-level command executions originating from SAP application server processes
• Anomalous changes to SAP system tables or configurations without corresponding change records
• Evidence of unauthorized data exports or system configuration modifications

Detection Strategies

• Monitor SAP Security Audit Log (SM21) for suspicious function module calls and authorization failures
• Implement SAP Solution Manager to track RFC traffic patterns and identify anomalous connections
• Enable enhanced logging for SAP Landscape Transformation activities and RFC gateway communications
• Deploy network-based detection for unusual RFC protocol patterns targeting SAP systems
• Use SentinelOne Singularity to detect malicious process spawning from SAP application server processes

Monitoring Recommendations

• Configure real-time alerting for dynamic ABAP code execution events in production environments
• Establish baseline RFC connection patterns and alert on deviations
• Monitor operating system-level process creation from SAP service accounts
• Review administrative action logs for SAP Landscape Transformation on a regular basis
• Implement continuous monitoring of SAP transport requests and code changes

How to Mitigate CVE-2026-0491

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3697979 immediately
• Review and restrict administrative access to SAP Landscape Transformation components
• Audit RFC destination configurations and remove unnecessary connections
• Implement additional authorization checks for RFC-enabled function modules
• Enable enhanced security logging for SAP Landscape Transformation activities

Patch Information

SAP has released a security patch to address this vulnerability as part of their Security Patch Day. Administrators should review SAP Note #3697979 for detailed patching instructions and apply the update to all affected systems. The patch addresses the missing authorization checks and input validation issues in the affected function module. Organizations should consult the SAP Security Patch Day portal for additional guidance and related security updates.

Workarounds

• Restrict network access to RFC interfaces using firewall rules and SAP gateway security configurations
• Implement SAP Gateway Security (secinfo and reginfo files) to limit RFC connections to trusted sources only
• Disable or restrict access to the vulnerable function module until patching is complete
• Apply the principle of least privilege to reduce the number of accounts with administrative access
• Implement network segmentation to isolate SAP systems from general user networks

# SAP Gateway Security Configuration Example
# Add to secinfo file to restrict RFC access to trusted hosts only
# Path: /usr/sap/<SID>/SYS/exe/run/sec

# Deny all by default
D * * *

# Allow specific trusted IP ranges for RFC connections
P TP=* HOST=192.168.1.0/24 USER=*
P TP=* HOST=10.0.0.0/8 USER=*

# Reload gateway configuration
# Execute: gw_reload -sec