The vulnerability is a code injection flaw in SAP S/4HANA’s RFC‑exposed function module. An attacker who has administrative privileges can inject arbitrary ABAP code or operating‑system commands, bypassing the system’s authorization checks. This capability effectively creates a backdoor that allows the attacker to read, modify, or delete data, disrupt services, or otherwise take full control of the system.

SAP S/4HANA (Private Cloud and On‑Premise) versions 10.2 through 10.9 are impacted, as evidenced by the associated CPE identifiers. The flaw exists in the function module that is made available via RFC calls in these releases.

The flaw carries a CVSS v3.1 score of 9.1, indicating critical severity. The EPSS score is reported as less than 1 %, implying a low probability that the vulnerability will be exploited in the wild, and it is not currently listed in the CISA KEV catalog. Attackers must possess administrative rights and must invoke the vulnerable RFC function module. Once the payload is delivered, the attacker can execute arbitrary code with the system’s privileges, potentially resulting in a full compromise of confidentiality, integrity, and availability.