CVE-2026-89107: SAP S/4HANA (Manage Substitution/Validation Rules) S4CORE 105, 106, 107, 108, 109

Affected technology

SAP S/4HANA (Manage Substitution/Validation Rules) · S4CORE 105, 106, 107, 108, 109
SAP_SE

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.