CVE-2026-120009: Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview)
SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an attacker to already have high privileges in the affected SAP ABAP Developer Tools AMDP Data Preview functionality. The issue is remotely exploitable and does not require user interaction.
What is the potential impact of successful exploitation?
A successful attacker could inject and execute arbitrary code on the system. This could fully compromise confidentiality, integrity, and availability.
What should be reviewed while planning remediation?
Review which users hold high privileges for the affected AMDP Data Preview functionality and whether those privileges are necessary. The provided information identifies SAP Note 3833364 as a remediation reference.