CVE-2026-0504
Low
Description
Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.
SeverityLow
CVSS3.8
Exploit probability—
ProductSAP Identity Management
PublishedJan 13, 2026
First seenJan 13, 2026
Weakness typeCWE-943CWE-943
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAP Identity Management | IDM_CLM_REST_API 8.0, IDMIC 8.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.