S4CRM XSLT Injection: CVE-2026-109795 · CVSS 3.0 9.9 · SAP Note 3834842
Note 3834842 covers remote-enabled functionality in the survey area of S/4HANA for customer management and SAP CRM. The function had no proper authorization check. Moreover, it passed user input into an XSLT transformation without enough validation. Consequently, a user with ordinary logon rights could call it over RFC and inject a transformation that runs code. SAP rates the S4CRM XSLT Injection at CVSS 9.9, HotNews. In this post, we cover exposure, the fix and what to check.
S4CRM XSLT Injection: affected components
The note lists S4CRM 204, 205 and 206, S4CEXT 107, 108 and 109, and BBPCRM 713 and 714. In addition, its keywords point to XSLT_TRANSFORMATION and SLIN_SEC findings. Therefore, the root cause of the S4CRM XSLT Injection is dynamic transformation handling inside the function.
Correction
SAP adds authorization checks. It also adds code that detects and stops this issue. Implement the correction instructions or the support package. Unfortunately, SAP offers no workaround.
Interim risk reduction
Without an official workaround for the S4CRM XSLT Injection, the practical lever is S_RFC. First, review which users and technical accounts hold broad S_RFC authorizations in CRM systems. For example, look for S_RFC with * for function groups. Then narrow those roles. After patching, review RFC entries in the security audit log as well. In particular, look for unusual callers of CRM survey function groups.
Why low privileges still matter
Any valid user can trigger the S4CRM XSLT Injection, including technical and interface accounts. Because of that, a single phished password is enough for code execution in the CRM system. So treat this note with the same urgency as the unauthenticated HotNews of the month.
S4CRM XSLT Injection: advisory details
Component: CRM-BF-SVY
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3834842 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
