CVE-2026-120009

high

Description

SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability.

References

https://url.sap/sapsecuritypatchday

https://me.sap.com/notes/3833364

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120695

Details

Source: Mitre, NVD

Published: 2026-11-10

Updated: 2026-11-11

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00476