Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

SAP S/4HANA rule editor lets privileged user run code

CVE-2026-89107 · published today
Summary

The rule‑definition feature in SAP S/4HANA does not check the data it receives, so a user who has certain business permissions can enter specially crafted input that is treated as program code. If exploited, this can let the attacker run any code they want on the system, potentially taking full control of the environment. Apply the vendor’s security update and limit the affected permissions to trusted administrators only.

Original advisory text
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticat...
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Type
CWE-94Code Injection
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-89107 · NVD
Track software like this
Free during beta