CVE-2026-89107
Received Received - Intake

ABAP Code Injection in SAP S/4HANA

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89107
EUVD
EUVD-2026-98190

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) S4CORE 105
SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) 106
SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) 107
SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) 108
SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) 109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker with specific privileges to submit crafted input that is interpreted as executable ABAP code. This leads to arbitrary code execution, compromising the entire system.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized ABAP code execution in SAP S/4HANA systems. Monitor for unusual rule definitions in the Manage Substitution/Validation Rules module. Review system logs for unexpected ABAP code execution attempts or modifications to rule definitions. Use SAP transaction codes like SE38 or SE80 to inspect ABAP programs for suspicious scripts.

Impact Analysis

An attacker could gain full control over the affected SAP S/4HANA system, leading to unauthorized data access, modification, or deletion. This could disrupt business operations and cause significant downtime.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Apply SAP Security Note 3805589 immediately to patch the vulnerability in SAP S/4HANA Manage Substitution/Validation Rules. Restrict user privileges to only those necessary for business operations and review rule definitions for suspicious ABAP code patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart