SAP fixes a critical S/4HANA flaw that allows arbitrary ABAP code execution
In its October Security Patch Day, SAP released a fix for CVE-2026-89107, a flaw rated 9.9 out of 10 in the substitution and validation rules component of S/4HANA. An authenticated user with certain business privileges could fully compromise the system.
What happened
SAP's Security Patch Day of 13 October 2026 includes a fix for CVE-2026-89107, a critical vulnerability in SAP S/4HANA, specifically in the "Manage Substitution/Validation Rules" functionality. The related SAP security note is 3805589.
The root cause is that the rule definition feature, which relies on a domain-specific scripting language, does not sufficiently validate the input it receives. An authenticated attacker holding certain business privileges can submit specially crafted input that the rule processing logic interprets as executable ABAP code.
Successful exploitation allows arbitrary ABAP code execution and full compromise of the affected system, with high impact on confidentiality, integrity and availability. Hence the CVSS score of 9.9 out of 10: the attack is network-based, low in complexity, requires no user interaction and breaks out of the scope of the vulnerable component.
Who is affected
This affects customers running SAP S/4HANA with the substitution and validation rules management functionality. The bulletin consulted does not list the specific affected and fixed versions; that detail is contained in security note 3805589, available through the SAP support portal.
The authentication requirement limits exploitation to users with a valid account and specific business privileges, but it does not reduce the severity: in SAP landscapes it is common for many internal users, suppliers or integrations to hold such profiles.
Exploitation status
There is currently no evidence of active exploitation: the vulnerability is not listed in CISA's KEV catalogue and no public exploit is known. It has not been given an EPSS score yet either, so there is no estimate of the likelihood of exploitation in the short term.
That said, SAP systems are a frequent target, and critical code execution flaws in S/4HANA have historically drawn attacker attention within weeks of a patch being released.
What to do
The recommendation is to apply SAP's correction as soon as possible, following the usual validation process in a test environment before moving to production.
- Identify and implement SAP security note 3805589 across all affected S/4HANA systems.
- Review the remaining notes published in SAP's October 2026 Security Patch Day and prioritise them by criticality.
- Review who holds the business privileges required to define substitution and validation rules, and remove any that are not justified.
- Verify that SAP systems are not directly exposed to the internet and that access goes through a VPN or controlled gateways.
- Enable and review the SAP security audit log, looking for unexpected rule definitions or changes.
Sources
Affected technologies
Vulnerabilities (1)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-89107 | Critical (9.9) | — | 10/12/2026 | Awaiting Analysis |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.