CVE-2026-89107

Name of the Vulnerable Software and Affected Versions SAP S/4HANA (affected versions not specified)

Description Insufficient input validation in the rule definition functionality, which uses a domain-specific scripting language, allows an authenticated attacker with specific business privileges to submit crafted input. This input is interpreted as executable ABAP code by the rule processing logic, enabling the execution of arbitrary ABAP code and potentially leading to a full system compromise affecting confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.