SAP Security Note 3805589 addresses a critical ABAP code injection vulnerability (CVE-2026-89107, CVSS 9.9) affecting the Manage Substitution/Validation Rules functionality in SAP S/4HANA. An authenticated attacker with the required business privileges could submit specially crafted rule definitions that are processed as executable ABAP code, potentially allowing arbitrary code execution and complete compromise of the SAP system. Exploitation could have a severe impact on the confidentiality, integrity, and availability of business data and system services. SAP has introduced additional validation to prevent malicious code from being processed and provides a temporary workaround that disables the affected OData service. SAP recommends implementing the permanent correction instructions or applicable Support Packages as a priority.
SAP Security Note 3798788 addresses a critical missing authorization check vulnerability (CVE-2026-89108, CVSS 9.1) in SAP Manufacturing Integration and Intelligence (MII) Configuration Service. An authenticated attacker with SAP XMII Admin privileges and network access to the affected endpoints could exploit insufficient authorization controls to create an account with elevated privileges on the underlying Java application server, potentially gaining administrative control beyond the MII application itself. Successful exploitation could have a high impact on the confidentiality, integrity, and availability of the affected system. SAP has corrected the vulnerability by strengthening authorization checks and preventing SAP XMII Admin users from creating accounts with the SAP_J2EE_Engine_Admin role. As no workaround is available, SAP recommends implementing the Support Packages and patches referenced in the security note as a priority.
SAP Security Note 3797111 resolves a critical broken access control vulnerability (CVE-2026-89110, CVSS 9.9) affecting SAP NetWeaver Visual Composer. Due to a security configuration that was not enabled by default, a low-privileged attacker could access internal functionality capable of executing operations against a preconfigured remote system. Depending on how the remote connection is configured, exploitation could ultimately provide control over the connected backend system, creating severe risks to its confidentiality, integrity, and availability. SAP has addressed the weakness by changing the default configuration to enforce the relevant security protection. Customers may enable Secure Mode as an interim mitigation, but this is not considered a permanent fix. Given the potential for compromise of connected SAP systems, customers should prioritize deployment of the Support Packages and patches specified in the security note.
SAP Security Note 3626303 resolves a high-severity missing authorization check vulnerability (CVE-2026-89120, CVSS 7.1) in the SAP ABAP Platform caused by a regression introduced through an API change. The flaw allows a low-privileged attacker to use specially crafted requests to bypass restrictions associated with the session manager and gain unintended access to the SAP Easy Access Menu, including scenarios involving single transaction mode and the Fiori Launchpad (FLP). Exploitation could enable unauthorized actions with a high impact on system integrity and a limited impact on confidentiality, although availability is not affected. SAP has remedied the regression by blocking unintended access to the Easy Access Menu and provides the correction through updated SAP Kernel patches.
SAP Security Note 3765424 addresses a high-severity memory corruption vulnerability (CVE-2026-58249) affecting the Internet Communication Manager (ICM) in SAP NetWeaver and SAP Web Dispatcher. A flaw in the HTTP/2 implementation allows an unauthenticated attacker to send specially crafted requests that trigger a memory-handling error and crash the affected process, potentially disrupting access to SAP applications and causing a significant impact on availability, while confidentiality and integrity are not affected. Systems are vulnerable only when HTTP/2 is enabled, which is the default for SAP NetWeaver/ABAP Platform and SAP Web Dispatcher with kernel 7.73 and higher. SAP has corrected the underlying program error through updated kernel and product patches. As an interim safeguard, HTTP/2 can be disabled using the icm/HTTP/support_http2 parameter, although SAP advises applying the relevant corrections as the permanent solution.
SAP Security Note 3800517 addresses a high-priority SQL injection vulnerability (CVE-2026-89113) in SAP Commerce Cloud that could allow an authenticated user to manipulate insufficiently validated input supplied to affected APIs and inject arbitrary SQL commands into database queries. Exploitation could expose sensitive application data and, depending on the underlying database engine, potentially allow data to be modified or deleted, creating a severe impact on confidentiality, integrity, and availability. SAP has eliminated the vulnerability by strengthening the validation and sanitization of affected input parameters and provides the correction in SAP Commerce Cloud 2211-jdk21.18 and later patches. As an interim measure, customers can disable the vulnerable input parameter, although this also removes the associated sorting functionality. Given the potential for unauthorized access and manipulation of application data, affected environments should be upgraded to the corrected SAP Commerce Cloud release as a priority.