An authenticated attacker can make SAP S/4HANA's Manage Substitution/Validation Rules component run arbitrary ABAP code, which can lead to full compromise of the system.
What Is It
CVE-2026-89107 is a code injection flaw (CWE-94) in the Manage Substitution/Validation Rules component of SAP S/4HANA. The rule definition feature uses a domain-specific scripting language, and it does not validate its input well enough. An authenticated attacker with specific business privileges can submit crafted input that the rule processing logic treats as executable ABAP code.
SAP, the CNA for this CVE, rates it CVSS 3.1 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The CVE record has been published, and NVD lists it as "Received."
Why It Matters
According to the vendor, successful exploitation lets an attacker run arbitrary ABAP code on the system. This could lead to full system compromise. The CVSS vector rates the potential impact on confidentiality, integrity and availability as high. The CVSS metrics show why the score is so high:
- Network-reachable, with low attack complexity
- Low privileges required. The attacker needs an authenticated account with specific business privileges, not admin access.
- No user interaction is needed
- Scope changed, so the impact reaches beyond the vulnerable component
S/4HANA often sits at the center of an organization's finance and operations. Any account that has the right business role should be treated as a possible path to full system takeover.
Exploitation status: The supplied CISA KEV data contains no entry for this CVE. Active exploitation is not confirmed by KEV, and there is no CISA-required action or due date.
What's Vulnerable
Vendor: SAP SE Product: SAP S/4HANA (Manage Substitution/Validation Rules)
Affected versions:
- S4CORE 105
- 106
- 107
- 108
- 109
All other versions are listed as unaffected by default. The NVD record does not yet include CPE data.
Patch Status
SAP's advisory record refers to SAP Note 3805589 and the SAP Security Patch Day page. Administrators running the affected S4CORE versions should:
- Review SAP Note 3805589 (an SAP support login is required) and apply the fix or workaround it gives.
- Check which users hold the business privileges needed to create or change substitution/validation rules, and cut that list down to what is strictly needed until the fix is in place.
The supplied data does not include fixed version numbers. Use SAP Note 3805589 as the source for those.
Sources
- NVD: CVE-2026-89107
- SAP Note 3805589
- SAP Security Patch Day
- CISA Known Exploited Vulnerabilities Catalog (no entry in the supplied data)