SAP S/4HANA Code Injection and Authorization Flaws

Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.

Improper authorization checks in SAP S/4HANA's Linear Asset Management RAP business object allow an authenticated, low-privilege user with local/interactive access to modify associated business object data for which they lack authorization, producing a high integrity impact with no confidentiality or availability impact (CVSS 4.7). Exploitation requires high attack complexity and specific runtime or data-association conditions, and no remote or unauthenticated path is described; no public exploit identified at time of analysis. SAP has assigned CWE-862 and published remediation guidance via SAP Security Note 3799621.