A missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA allows an authenticated attacker to access a specific transaction code and change text data stored in the system. The flaw does not expose sensitive information or disrupt system availability, but it directly alters application integrity, potentially corrupting business records.

The vulnerability affects SAP NetWeaver Basis releases 7.0 through 8.16, which include SAP NetWeaver Application Server ABAP and SAP S/4HANA. Any installation of these components that has not applied the defined fix is potentially exposed.

The CVSS score of 6.5 indicates a moderate to high risk, and the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires a valid authenticated session, so it is typically confined to internal users who have sufficient privileges to execute the vulnerable transaction. Once accessed, the attacker can modify application data, which may lead to downstream processing errors or false reporting.