The vulnerability resides in SAP Landscape Transformation, allowing an attacker with administrative rights to leverage a remote function module exposed via RFC to inject arbitrary ABAP code and operating system commands. The flaw bypasses essential authorization checks, effectively creating a backdoor. As described, an attacker could execute code with system privileges, resulting in loss of confidentiality, integrity, and availability. The weakness is a classic code injection flaw as identified by CWE-94.

SAP Landscape Transformation from SAP SE is affected. No version details were supplied, but the issue applies to all deployments configured to allow RFC access to the function module used for landscape transformations.

The CVSS score of 9.1 categorizes the issue as critical. The EPSS score of less than 1% indicates that exploitation is not currently widespread, but the presence of a backdoor means the risk is high if an attacker gains the necessary administrative privileges. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires access to the RFC interface and administrative credentials; once achieved, the attacker can execute arbitrary code on the host system. Given the severity and the potential for complete system takeover, organizations should treat this as a critical priority.