CVE-2026-0500: Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)

Published Jan 13, 2026

Updated

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.

Affected Software

2 affected components

SAP Wily Introscope Enterprise Manager (WorkStation)

SAP Introscope Enterprise Manager=10.8

Remediation

Patch Available

https://url.sap/sapsecuritypatchday

Event History

Jan 13, 2026

CVE Published

via MITRE·01:13 AM

Data Sourced

via MITRE·01:13 AM

DescriptionSeverity

Data Sourced

via NVD·02:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0500?

CVE-2026-0500 has been assigned a critical severity level due to the potential for remote code execution.

How do I fix CVE-2026-0500?

To mitigate CVE-2026-0500, upgrade SAP Wily Introscope Enterprise Manager (WorkStation) to the latest secure version provided by SAP.

Who is affected by CVE-2026-0500?

CVE-2026-0500 affects users of SAP Wily Introscope Enterprise Manager (WorkStation) that utilize the vulnerable third-party component.

What type of vulnerability is CVE-2026-0500?

CVE-2026-0500 is classified as a remote code execution vulnerability.

Can CVE-2026-0500 be exploited without authentication?

Yes, CVE-2026-0500 can be exploited by unauthenticated attackers through a malicious JNLP file.