Sap Erp And Sap S 4 Hana Private Cloud And On Premise EUVD-2026-22166

Authenticated user account required on SAP ERP or SAP S/4HANA (Private Cloud or On-Premise). Attacker executes specific ABAP report to overwrite eight-character executable ABAP reports. No victim interaction needed. Default configurations vulnerable.

Real-world risk assessment requires balancing multiple signals. The CVSS 7.1 score reflects network-accessible attack vector (AV:N), low complexity (AC:L), and requires only low-privilege authentication (PR:L) with no user interaction (UI:N), making this technically easy to exploit once credentials are obtained. The impact profile shows high availability risk (A:H) with limited integrity impact (I:L) confined to the overwritten report. Without EPSS data, we cannot quantify statistical exploitation probability, and no public exploit code has been identified, reducing immediate weaponization risk. However, the authentication bypass nature (tagged as such) combined with network accessibility and low complexity elevates this above typical authenticated vulnerabilities. The confined scope (S:U) limits lateral impact to the vulnerable component. For organizations running SAP ERP or S/4HANA, this represents a moderate-to-high priority due to the potential for insider threats or compromised low-privilege accounts to disrupt critical business processes by corrupting essential ABAP reports. The limitation to eight-character report names provides some scope constraint but does not eliminate risk, as many legacy and system reports use this naming convention.

An attacker with compromised low-privilege SAP user credentials (such as a basic business user account) authenticates to the SAP system remotely over the network. They execute the vulnerable ABAP report and supply parameters to overwrite a critical eight-character executable report used for financial closing processes or inventory management. When legitimate users or scheduled jobs subsequently execute the corrupted report, the intended business functionality fails, causing operational disruptions and potentially delaying critical business processes. No public exploit code exists, but the low complexity and network accessibility make manual exploitation straightforward for attackers familiar with ABAP programming.