Vulnerability details

CVE-2026-89107

SAP_SE SAP S/4HANA

Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

CVSS 3.1

9.9Critical

Official description

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

CVSS scores

Score	Version	Source	Vector
9.9Critical	3.1	CVEProject cvelistV5 (CNA) (sap)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
SAP_SE	SAP S/4HANA (Manage Substitution/Validation Rules)	106	CVEProject cvelistV5 (CNA)
SAP_SE	SAP S/4HANA (Manage Substitution/Validation Rules)	107	CVEProject cvelistV5 (CNA)
SAP_SE	SAP S/4HANA (Manage Substitution/Validation Rules)	108	CVEProject cvelistV5 (CNA)
SAP_SE	SAP S/4HANA (Manage Substitution/Validation Rules)	109	CVEProject cvelistV5 (CNA)
SAP_SE	SAP S/4HANA (Manage Substitution/Validation Rules)	S4CORE 105	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-13
Last updated: 2026-10-14
State: Published
Assigner (CNA): sap
Kolun priority: 25 · Low

Exploit prediction (EPSS)

0.48%

Probability of exploitation in 30 days

41.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code