CVE-2026-89107: sap_se sap s/4hana (manage substitution/validation rules) Code Injection

Vulnerability summary

CVE-2026-89107 is a critical (CVSS 9.9) Code Injection vulnerability in sap_se sap s/4hana (manage substitution/validation rules). EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.1% of scored vulnerabilities.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.