CVE-2025-27429
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
Reserved 2025-02-25 | Published 2025-04-08 | Updated 2025-04-14 | Assigner sapCWE-94: Improper Control of Generation of Code ('Code Injection')
Support options
