CVE-2026-89107: Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the specific business privileges needed to use the rule definition functionality in Manage Substitution/Validation Rules. The provided information does not indicate that unauthenticated users can exploit it.
What access does successful exploitation provide?
A successful attacker can cause crafted rule input to be interpreted as executable ABAP code and execute arbitrary ABAP code in the system. This can result in full system compromise with high confidentiality, integrity, and availability impact.
Which component should be prioritized for review?
Prioritize SAP S/4HANA systems where users can access Manage Substitution/Validation Rules and define rules using its domain-specific scripting language. Review which accounts hold the relevant business privileges, since those privileges are required for exploitation.