SAP S/4HANA Enterprise Search EUVD-2026-29371

Requires valid authentication credentials for SAP S/4HANA with access to the Enterprise Search for ABAP functionality. The attacker must have authorization to execute search queries, typically granted through standard business user roles (ESS, MSS, or application-specific roles like SAP_BC_BMT_WDA_ESH). The vulnerability exists when the Enterprise Search component is deployed and enabled, which is common in modern S/4HANA implementations using Fiori search capabilities. Exploitation is limited by the database privileges of the ABAP application user account - if running with restricted database permissions, data access is constrained to tables accessible by that technical user, though this still typically includes most business data. The Changed scope (S:C) suggests exploitation may extend beyond these normal boundaries. No special network positioning required beyond network access to SAP Gateway/Web Dispatcher endpoints (typically ports 443/8000/44300).

This vulnerability presents elevated real-world risk despite requiring authentication (PR:L). The CVSS 9.6 score reflects accurate severity: network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and critically - scope change (S:C) enabling impact beyond the vulnerable component. The Changed scope is particularly concerning in SAP environments where a single S/4HANA instance consolidates enterprise-wide data across modules (FI, CO, SD, MM, HR). An authenticated attacker with low-privilege search access could extract data from unrelated business areas. The authentication bypass tag warrants investigation - it may indicate the SQLi can be chained to bypass authentication controls, though this is not explicitly confirmed in the description. No EPSS score provided, but SQLi vulnerabilities in enterprise ERP systems typically attract attacker attention due to high-value data exposure. Patch availability via SAP Note 3724838 reduces urgency for organizations with active patch management, but SAP environments notoriously lag in patching due to change control processes and testing requirements. No public exploit identified at time of analysis, providing a patching window before widespread exploitation attempts.

An attacker with valid low-privilege SAP user credentials (such as a contractor with basic ESS/MSS access) authenticates to the S/4HANA system and accesses the Enterprise Search interface available through standard Fiori launchpad tiles or ABAP transaction codes. They craft a search query containing SQL metacharacters such as single quotes, UNION statements, or database-specific syntax (e.g., HANA's SELECT FROM SYS schema views) designed to extract database metadata, user credentials, or sensitive business data from tables they should not access. The malicious query bypasses application-level authorization checks, directly executing against the database. The attacker iteratively refines queries to dump customer master data, financial records, or HR information, and could terminate critical database connections to cause application-wide denial of service impacting all concurrent users.