Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-89107

Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules)

Default version status: unaffected

  • S4CORE 105affected
  • 106affected
  • 107affected
  • 108affected
  • 109affected

References