CVE-2026-34260: SAP S/4HANA SQL Injection (CWE-89) in Enterprise Search for ABAP
SAP has published CVE-2026-34260, a critical SQL injection flaw in SAP S/4HANA (SAP Enterprise Search for ABAP) that an authenticated user can trigger through user-controlled input. The CNA score is 9.6 under CVSS 3.1, with high impact on confidentiality and availability and no integrity impact. The record lists no affected or fixed versions, so administrators should consult the SAP references to confirm applicability and patch status.
Overview
SAP S/4HANA, through the SAP Enterprise Search for ABAP component, is affected by a SQL injection flaw classified as CWE-89. According to the record, user-controlled input is concatenated directly into SQL queries without adequate validation or sanitization, and the authentication requirement is low privilege.
Impact
- Confidentiality: High, according to the CNA scoring. An attacker may gain unauthorized access to sensitive database information.
- Integrity: Not affected, according to the CNA scoring.
- Availability: High. The description states the application could potentially crash.
- The CNA score is 9.6 under CVSS 3.1 with a critical severity rating. Scope is recorded as changed in the vector.
Affected products and versions
The record does not list any affected or fixed versions. Verify applicability against the vendor references below:
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog in the consulted data, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00431 with a percentile of 0.3562. These figures are estimates and do not confirm exploitation.
Remediation and mitigation
- Review the SAP security notes referenced by the vendor and apply the corrections relevant to your S/4HANA release and SAP Enterprise Search for ABAP components.
- Restrict access for authenticated accounts to the affected functionality to users who require it.
- Apply least privilege to the database accounts used by the application so that a successful injection has a limited reach.
- Track vendor updates on the SAP Security Patch Day channel until the applicability to your landscape is confirmed.
Detection guidance
- Review application and database logs for unexpected database errors, unusual query failures, or repeated application crashes linked to search functionality.
- Monitor authenticated sessions for atypical search activity or input patterns that differ from normal usage.
- Correlate application restarts or service instability with user activity to identify potential abuse.
Limitations of the available information
The record contains no affected product versions, no fixed versions, no vendor-provided technical details beyond the description, and no product-specific exploitation data. The SAP references were listed but their content was not available for this analysis, so the exact remediation path must be confirmed directly with SAP.
Frequently asked questions
What type of vulnerability is CVE-2026-34260?
It is a SQL injection flaw classified as CWE-89, in which user-controlled input is concatenated into SQL queries without adequate validation.
Is CVE-2026-34260 known to be actively exploited?
It is not listed in the CISA KEV catalog in the consulted data, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record does not list affected or fixed versions. Check the SAP Security Patch Day and SAP Note 3724838 references to confirm applicability.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.