Vulnerability · Published Oct 13, 2026 · Assigned by sap
CVE-2026-89107Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
Critical 9.9
In plain English
A critical-severity code injection in SAP S/4HANA (Manage Substitution/Validation Rules) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP S/4HANA (Manage Substitution/Validation Rules) | S4CORE 105106107108109 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H