Vulnerability · Published Jan 13, 2026 · Assigned by sap

CVE-2026-0504Insufficient Input Handling in JNDI Operations of SAP Identity Management

Low 3.8

In plain English

A low-severity security flaw in SAP Identity Management from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Identity Management	IDM_CLM_REST_API 8.0IDMIC 8.0

Weakness: CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References