CVE-2026-89107 · CVSS 3.0 9.9 · SAP Note 3805589
A business rule should not become a way to run arbitrary ABAP. That is the boundary SAP fixes in Note 3805589. Input accepted by Manage Substitution/Validation Rules could reach the rule processor as executable code, giving a suitably authorized user a route to compromise the affected S/4HANA system. SAP assigns CVSS 9.9 and HotNews priority.
The permissions that matter
The attacker needs an authenticated account with a business role for one of the affected Fiori applications. SAP describes low privileges in the CVSS vector, but this does not mean every ordinary account can exploit the issue. Check the roles for the rule-management apps actually deployed, including F4406 for journal entries. No victim interaction is required. The potential consequences extend across data confidentiality, integrity and system availability.
Affected releases and correction
The note covers S4CORE 105 through 109. SAP’s FAQ 3810181 also states that Private Cloud releases from OP 2020 SP00 through OP 2025 SP02 are affected. Apply the correction instructions appropriate to the installed release and their prerequisites. Listed support packages are S4CORE 105 SP13, 106 SP11, 107 SP09, 108 SP07 and 109 SP03. The FAQ says no additional manual configuration is needed after the correction instructions are applied.
A temporary restriction has a business cost
SAP documents a temporary option to deactivate the rule-management OData service in /IWFND/MAINT_SERVICE. Its default technical name is ZUI_SUBSTNVALDNRULE_MANAGE; its external name is UI_SUBSTNVALDNRULE_MANAGE. This blocks creating, changing and deleting rules in the related Fiori apps. It does not amount to switching off the entire rule engine. Agree the interruption with Finance before using it and keep the permanent correction on the change plan.
What to check after implementation
Record the applied note version and correction status, then run representative business transactions and legitimate rule-maintenance workflows. The main note says existing rules are not affected, while the FAQ clarifies that rules containing vulnerable constructs will no longer execute. Include transported rules in the review. A successful SNOTE import is useful evidence; deliberately attempting ABAP injection in production is not a sensible acceptance test.
Advisory details
Component: FI-SL-VSR
SAP priority: HotNews
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3805589 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
