Answer in brief
CVE-2026-89107 records a Critical severity (CVSS 9.9) vulnerability in Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules). The current sources do not mark it as known exploited. The current feed maps SAP_SE/SAP S/4HANA (Manage Substitution/Validation Rules) (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SAP_SE/SAP S/4HANA (Manage Substitution/Validation Rules) (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SAP_SE/SAP S/4HANA (Manage Substitution/Validation Rules)generic | S4CORE 105 || 106 || 107 || 108 || 109 | Not reported |
Published upstream
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 13, 2026
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.
Quoted source text, attributed separately from HOL analysis.