critical2026-10-13SAP S/4HANA — Manage Substitution/Validation RulesCVE-2026-89107
Code Injection in Substitution/Validation Rule Management
SAP S/4HANA
Our Take
This is the "business role equals system access" story in one note. Nobody gave these users admin rights, but the app turns a modelling task into code execution. Your role review probably says these people are fine; the patch says otherwise. Fix the note, then audit who can edit rules.
Vulnerability Detail
Weak input validation in the rule-management app lets rule input be executed as ABAP. A user holding the relevant rule-management business role could run arbitrary code without any administrator rights.
Patch Action
Apply the correction from SAP Note 3805589. While you schedule it, review who holds the substitution/validation rule-management roles and trim anything unnecessary.
Affected Versions
S4CORE 105–109
Patch Info