CVE-2026-0504: SAP Identity Management Information Disclosure

CVE-2026-0504 Overview

CVE-2026-0504 is a JNDI injection vulnerability affecting the SAP Identity Management REST interface. Due to insufficient input handling, the REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This vulnerability falls under CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), indicating a failure to properly sanitize user-controlled input before it reaches JNDI lookup operations.

Critical Impact

Authenticated administrators can exploit this vulnerability to achieve limited disclosure or modification of data through malicious JNDI requests, potentially leading to information leakage or unauthorized data manipulation within the SAP Identity Management environment.

Affected Products

• SAP Identity Management (REST Interface component)

Discovery Timeline

• January 13, 2026 - CVE-2026-0504 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0504

Vulnerability Analysis

This vulnerability stems from improper neutralization of special elements within data query logic (CWE-943) in the SAP Identity Management REST interface. The JNDI (Java Naming and Directory Interface) subsystem processes REST requests without sufficient validation or sanitization of user-supplied input. While the vulnerability requires high privileges (administrator access) and authentication to exploit, it enables attackers to craft malicious REST requests that manipulate JNDI lookup operations.

The exploitation path requires network access and valid administrator credentials, limiting the attack surface. However, once authenticated, a malicious or compromised administrator can leverage the insufficient input handling to query or modify data through the JNDI interface in unintended ways. The impact is constrained to low confidentiality and integrity impacts with no effect on availability, reflecting the limited scope of data that can be accessed or modified.

Root Cause

The root cause is insufficient input neutralization within the REST interface's JNDI operation handlers. User-controlled data from REST requests is passed directly to JNDI lookup or query operations without proper sanitization of special characters or injection sequences. This allows specially crafted payloads to alter the intended behavior of JNDI operations, potentially revealing sensitive directory information or modifying data entries.

Attack Vector

The attack vector is network-based, requiring an authenticated administrator session to the SAP Identity Management REST interface. An attacker with valid administrator credentials can craft malicious REST API requests containing injection payloads targeting the JNDI operations. These crafted requests bypass input validation and interact directly with the underlying directory services, enabling limited data disclosure or modification.

The vulnerability exploitation flow involves:

1. Attacker authenticates as an administrator to the SAP Identity Management REST interface
2. Attacker crafts REST requests with specially formatted JNDI injection payloads
3. The application processes these requests without adequate input neutralization
4. JNDI operations execute with attacker-controlled parameters, leading to unauthorized data access or modification

Detection Methods for CVE-2026-0504

Indicators of Compromise

• Unusual REST API requests to SAP Identity Management containing JNDI-related syntax patterns such as ${jndi: or directory traversal sequences
• Anomalous administrator activity with repeated API calls to identity management endpoints
• Unexpected data modifications or queries in directory services logs associated with the SAP Identity Management service

Detection Strategies

• Monitor SAP Identity Management REST API logs for requests containing suspicious JNDI injection patterns
• Implement application-layer inspection for REST requests with special characters commonly used in injection attacks
• Configure alerting on administrator account activity that deviates from baseline behavior patterns
• Enable detailed logging on JNDI operations within the SAP Identity Management environment

Monitoring Recommendations

• Enable verbose logging on SAP Identity Management REST interface endpoints
• Correlate administrator authentication events with subsequent REST API activity
• Monitor directory service query patterns for anomalies that may indicate exploitation attempts
• Review administrator account access and ensure principle of least privilege is enforced

How to Mitigate CVE-2026-0504

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3657998 immediately
• Review administrator accounts for any suspicious activity or unauthorized access
• Audit current administrator permissions and reduce unnecessary privilege assignments
• Enable enhanced logging on SAP Identity Management REST interface to detect potential exploitation attempts

Patch Information

SAP has released a security patch addressing this vulnerability. Organizations should obtain and apply the patch from SAP Note #3657998. Additional security patch information is available through the SAP Security Patch Day portal. The patch implements proper input neutralization for REST requests processed by JNDI operations.

Workarounds

• Restrict network access to the SAP Identity Management REST interface to trusted management networks only
• Implement additional authentication controls such as multi-factor authentication for administrator accounts
• Deploy a web application firewall (WAF) with rules to detect and block JNDI injection patterns in REST requests
• Review and limit the number of accounts with administrator privileges to reduce the attack surface