EXPOSURES › CVE-2026-89107
CVE-2026-89107
CRITICALSAP S/4HANA's rule definition functionality fails to validate input, allowing authenticated attackers with business privileges to execute arbitrary ABAP code and fully compromise the system.
SAP S/4HANA does not sufficiently validate input in its Manage Substitution/Validation Rules feature, which interprets specially crafted input as executable ABAP code. This allows an authenticated attacker with specific business privileges to execute arbitrary code, leading to full system compromise and severe impacts on confidentiality, integrity, and availability. DIB organizations must ensure strict input validation and least-privilege access to prevent similar code-execution vulnerabilities in enterprise applications.
Shame score — A critical RCE vulnerability in a widely deployed enterprise ERP system that allows full system compromise via arbitrary code execution, representing a severe avoidable failure in input validation.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.