All vulnerabilities
CVE-2026-89107

Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules)Applications & CMS
Open in ThreatlineRecord JSON
CVSS
9.9Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

Text from CVE List

Affected versions 5

  • SAP S/4HANA (Manage Substitution/Validation Rules)affected: S4CORE 105CVE List
  • SAP S/4HANA (Manage Substitution/Validation Rules)affected: 106CVE List
  • SAP S/4HANA (Manage Substitution/Validation Rules)affected: 107CVE List
  • SAP S/4HANA (Manage Substitution/Validation Rules)affected: 108CVE List
  • SAP S/4HANA (Manage Substitution/Validation Rules)affected: 109CVE List

References 2