This vulnerability is caused by an uncontrolled resource consumption flaw within a remote‑enabled function module. An authenticated user with normal privileges can repeatedly call the module with an overly large loop‑control parameter, forcing a long‑running loop that consumes significant CPU and memory resources. The result is a denial‑of‑service condition that makes the affected SAP Supply Chain Management system unavailable, while confidentiality and integrity of data remain unaffected.

The flaw affects SAP Supply Chain Management products across versions 700 through 714, and also impacts Advanced Planning and Optimization versions 713 and 714. Authorized users with network access to the affected systems are able to trigger the vulnerability.

The CVSS score of 7.7 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication, meaning that the attack surface is limited to users who already have legitimate system access. Nonetheless, once enabled, the attack can render the system unusable.