Riskcovery

CVE-2026-89107

Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

State
Published
Severity
9.9 Critical
Published
Oct 13, 2026
Updated
Oct 14, 2026
Reserved
Sep 10, 2026

Read the record on cve.org

Description

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsap

Weaknesses

  • CWE-94 Improper Control of Generation of Code

Affected Products

ProductVersions
SAP S/4HANA (Manage Substitution/Validation Rules)SAP_SE
  • S4CORE 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • 109Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.