ADT AMDP Data Preview Code Injection: CVE-2026-120009 · CVSS 3.0 7.2 · SAP Note 3833364
Note 3833364 covers AMDP Data Preview in ABAP Development Tools. The feature let ABAP expressions inside SQL statements supply values dynamically, and that went beyond its intended scope. As a result, a user with high privileges could inject and execute code. Moreover, they could modify data they should not reach. SAP rates this issue at CVSS 7.2, High. In this post, we cover exposure, the fix and what to check.
ADT AMDP Data Preview Code Injection: fix
The ADT AMDP Data Preview Code Injection affects SAP_BASIS 740 and 750 to 816, plus 920. SAP deprecates the affected functionality. So implement the correction instructions or the support package. In addition, FAQ note 3840292 answers common questions.
Why developers in production matter
The attacker needs developer-level rights. Therefore, the main risk of this issue lies in systems where ADT access is broader than it should be. For example, think of production systems with developer keys, or QA systems that hold production data. Use this note as a reason to check who holds S_DEVELOP and S_ADT_RES there.
Workaround
SAP’s only interim mitigation is to revoke ADT access completely. Most teams, however, will only do that in production. So in other systems, patching is the practical answer to this issue.
What to check
First, list users with S_DEVELOP in production and QA. Next, compare the list with the people who really need it, and remove the rest. Finally, review whether firefighter or emergency access covers developer rights, because that is where this attack would hurt most.
ADT AMDP Data Preview Code Injection: advisory details
Component: BC-DWB-AIE-DP
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: SAP Security Note 3833364 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
