An RFC‑exposed function module in SAP Landscape Transformation allows a high privileged user to inject arbitrary ABAP code and operating‑system commands. The injected code can alter system behavior, but the attacker cannot fully control what changes occur; the result is limited primarily to integrity with no direct impact on confidentiality or availability.

The vulnerability applies to the SAP Landscape Transformation product from SAP SE. No specific product versions are listed, so administrators should verify whether their installations are covered by this issue.

The CVSS score of 2 indicates a low severity assessment. EPSS information is not available and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be a remote interaction via the exposed RFC function, requiring a high‑privileged account. The combination of low severity and high privilege requirement leads to a low overall risk, yet the availability of an exploitation path warrants patching to prevent potential integrity violations.