CVE-2026-34260: SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34260?
CVE-2026-34260 is considered a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2026-34260?
To fix CVE-2026-34260, apply the recommended patches provided by SAP for SAP S/4HANA (SAP Enterprise Search for ABAP).
Who is affected by CVE-2026-34260?
CVE-2026-34260 affects users of SAP S/4HANA (SAP Enterprise Search for ABAP) that allow user-controlled input.
What kind of attack can be executed using CVE-2026-34260?
CVE-2026-34260 allows an authenticated attacker to execute arbitrary SQL commands, potentially compromising the database.
What are the implications of exploiting CVE-2026-34260?
Exploiting CVE-2026-34260 can lead to unauthorized data access, data manipulation, or complete database compromise.