An authenticated attacker with regular user rights and network access can repeatedly call a remote-enabled function module in SAP Supply Chain Management, supplying an excessively large loop-control parameter that forces the function to execute a long loop and consume excessive CPU and memory resources. The attack does not affect confidentiality or integrity, but it can render the application or the host machine unavailable until the system recovers or is restarted.

SAP Supply Chain Management products disclosed under SAP_SE. No specific version details are provided, so any instance of the application that implements the vulnerable function module and is reachable over the network may be impacted.

The vulnerability has a CVSS score of 7.7, classifying it as high severity, yet the EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The attack requires network connectivity to the SAP application and valid user credentials but does not require elevated privileges. Because the exploit path is a remote function call with a controllable parameter, it is inferred that the attack vector is remote over the network. The vulnerability is not listed in the CISA KEV catalog.