The flaw is an OS command injection (CWE‑77) in SAP Forecasting & Replenishment. When an authenticated user with administrative privileges triggers a non‑remote‑enabled function, arbitrary operating system commands can be executed. This capability allows the attacker to read or modify any system data and to shut down the system, leading to a complete compromise of confidentiality, integrity, and availability.

The vulnerable component is SAP Forecasting & Replenishment. No specific version range is disclosed in the advisory, so all installations may be affected until SAP issues a fix. Administrators should verify the product version and consult the referenced SAP notes for patch details.

The CVSS score of 8.2 indicates a high severity. EPSS is not available, and the issue is not listed in CISA KEV, implying no publicly confirmed exploit yet. The attack requires authenticated administrative access, which is likely granted to a limited set of users. However, the ability to run arbitrary OS commands makes the vulnerability a critical risk if privileged accounts are compromised or misused.