SAP ABAP Platform CVE-2026-89120

Exploitation requires an authenticated low-privileged SAP account (CVSS PR:L) and that the session manager be reachable such that it can be opened in single transaction mode - including via the Fiori Launchpad (FLP), so environments exposing FLP to a broad low-privilege user base are most at risk. The condition is specifically this regression: a SAP API change reintroduced the previously fixed authorization weakness, so only SAP ABAP Platform versions carrying that regressed API (not yet patched per SAP Note 3626303) are exploitable. Limiting factors: valid credentials are mandatory (no anonymous/pre-auth path), no availability impact is possible, and confidentiality exposure is low - the realistic blast radius is unauthorized integrity-affecting actions, not data theft or outage.

This is a moderate-priority, authenticated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N = 7.1 High) indicates network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold a low-privileged, authenticated SAP account - so this is a privilege-escalation/authorization-bypass primitive for an insider or a credential-holding adversary, not a pre-auth internet mass-exploitation bug. The primary damage is to integrity (I:H): the restriction bypass lets the attacker reach functionality or data manipulation they should be blocked from, with only low confidentiality exposure (C:L) and no availability impact (A:N). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public POC is referenced, so exploitation status is: no public exploit identified at time of analysis. Notably this is a REGRESSION - SAP states a prior fix was undone by an API change reintroducing a known authorization weakness (CWE-1188), which raises the practical likelihood that exploitation techniques for the original flaw may already be understood by researchers even though no current POC is published. Net: a real patch-cycle priority for SAP shops (especially where Fiori Launchpad/FLP is broadly exposed to many low-privilege users), but the authentication requirement and lack of KEV/EPSS/POC signals argue against treating it as an active widespread-exploitation event.

A low-privileged authenticated SAP user (or an attacker who has phished/obtained such credentials) sends specially crafted requests that open the session manager in single transaction mode - reachable including from the Fiori Launchpad - to bypass authorization restrictions and perform integrity-impacting actions they should not be permitted. No public exploit code is currently identified, and because the flaw is a regression of a previously fixed weakness, the exploitation approach for the original issue may be a useful starting point for an attacker.