The vulnerability is a code injection flaw that arises from insufficient validation of input in SAP S/4HANA’s Manage Substitution/Validation Rules feature, which uses a domain‑specific scripting language. An attacker who is authenticated and has specific business privileges can submit specially crafted input that is interpreted as executable ABAP code by the rule processing logic. Successful exploitation allows the attacker to run arbitrary ABAP code, which can lead to full compromise of the affected system and severe degradation of confidentiality, integrity and availability.

SAP S/4HANA, specifically the Manage Substitution/Validation Rules functionality. No version information is provided; the issue applies to all affected installations that use this feature.

The CVSS score of 9.9 indicates a critical severity, while the EPSS score is unavailable but the high CVSS suggests an elevated likelihood of exploitation. The vulnerability requires an authenticated user with particular business privileges, implying that the attack vector is most likely internal or staged via legitimate user accounts. The lack of a KEV listing does not reduce the risk; the combination of required privileges and high code execution potential results in almost certain compromise if exploited.