CVE-2026-0504 - Insufficient Input Handling in JNDI Operations of SAP Identity Management · CoreCVE

Back Back to CVE browser

LOW

Insufficient Input Handling in JNDI Operations of SAP Identity Management

Published Jan 13, 2026

3.8

LOW

CVSS 3.1

EPSS 0.19%

Description

Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.

Affected products

Vendor SAP SE Product SAP Identity Management Default
unaffected
Affected
- IDMIC 8.0
- IDM_CLM_REST_API 8.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SAP SE	SAP Identity Management	unaffected	Affected IDMIC 8.0 IDM_CLM_REST_API 8.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-943

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2377		Advisory
https://me.sap.com/notes/3657998
https://url.sap/sapsecuritypatchday

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Jan 13, 2026

Updated Jan 13, 2026

Reserved Dec 9, 2025

Link CVE-2026-0504

CISA Vulnrichment

Updated Jan 13, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-0504

Red Hat

No data

ENISA EUVD

Assigner sap

Published Jan 13, 2026

Updated Jan 13, 2026

Link EUVD-2026-2377

GitHub

No data