Code Injection vulnerability in SAP Landscape Transformation (SAP_SE SAP Landscape Transformation)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Awaiting Analysis
Description
SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileged adversary to inject arbitrary ABAP code and operating system commands. Due to this, some information could be modified, but the attacker does not have control over kind or degree. This leads to a low impact on integrity, while confidentiality and availability are not impacted.
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 2.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N | sap |
| CVSS 3.1 | LOW 2.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-22147
- GCVE · GCVE-0-2026-27675
CERT-FR advisories
- CERTFR-2026-AVI-0434 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Landscape Transformation | affected DMIS 2011_1_700 ; affected 2011_1_710 ; affected 2011_1_730 ; affected 2011_1_731 ; affected 2011_1_752 ; affected 2020 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |