by Kastro
Paper/Archive/CVE-2026-89107

CVE-2026-89107

SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) — Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 41.4.414 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

Affected

ProductAffectedFixed inSource
SAP S/4HANA (Manage Substitution/Validation Rules)S4CORE 105–CNA
SAP S/4HANA (Manage Substitution/Validation Rules)106–CNA
SAP S/4HANA (Manage Substitution/Validation Rules)107–CNA
SAP S/4HANA (Manage Substitution/Validation Rules)108–CNA
SAP S/4HANA (Manage Substitution/Validation Rules)109–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3805589refurl.sap/sapsecuritypatchday