{"id":"CVE-2026-89107","published":"2026-10-13T01:16:47.507","lastModified":"2026-10-15T20:38:04.303","description":"SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3805589","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP S/4HANA allows authenticated attackers with specific business privileges to execute arbitrary ABAP code through insufficient input validation in rule definition functionality. This vulnerability can lead to complete system compromise with high impact on confidentiality, integrity, and availability.","exploitability":"Exploitation requires an authenticated user with specific business privileges and is moderately difficult, requiring crafting of specially crafted input that gets interpreted as executable ABAP code by the rule processing logic.","blast_radius":"If exploited, this vulnerability could result in full system compromise affecting all data and services within the SAP S/4HANA environment, with potential for lateral movement and data exfiltration across the enterprise.","remediation":"No fixed version is published yet, but organizations should disable the affected rule definition functionality until a patch is available or implement strict access controls and monitoring of business user accounts with elevated privileges.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","abap","sap","business-logic"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:46:55.238Z"}}