An authenticated user can inject arbitrary SQL through unvalidated input in SAP S/4HANA (SAP Enterprise Search for ABAP). The application concatenates this input directly into database queries, enabling the attacker to read sensitive data or execute destructive statements. Successful exploitation would compromise confidentiality by exposing confidential database contents and could lead to application crashes, impacting availability. Integrity remains unaffected in the described vulnerability.

The affected system is SAP SE’s SAP S/4HANA with the Enterprise Search for ABAP component. No specific version range is disclosed in the available data, so all installations that include this component may be vulnerable.

The CVSS score of 9.6 indicates a critical severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires an authenticated user to submit malicious input; therefore, the risk is higher in environments where user privileges are not tightly controlled. With the provided score, the potential for exploitation is significant if a privileged user or compromised account can interact with the vulnerable component.