Act nowDisclosed

Advisory · CVE-2026-109795

SAP S4CRM code injection can let a low-privileged user execute arbitrary code

SAP NetWeaver S4CRM does not perform authorization checks or sufficient input validation in remote-enabled functionality, letting a low-privileged attacker inject and execute arbitrary code. SAP rates it CVSS 3.1 9.9.

Advisory published November 10, 2026Independent summary
Vendor
SAP
Product
S4CRM
Identifier / CWE
CVE-2026-109795
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

S4CRM trusts input from a low-privilege user without checking it properly, so a crafted request can smuggle in commands the system then runs.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Low-privileged access

    An attacker with low privileges reaches the affected S4CRM remote-enabled functionality.

  2. 02Crafted input sent

    The attacker sends specially crafted input through the remote interface.

  3. 03Checks missing

    The functionality does not perform the necessary authorization checks or input validation.

  4. 04Code executes

    The crafted input is injected and executed as code within the affected system.

  5. 05Reach extends

    Exploitation can extend beyond the vulnerable component, with high impact on confidentiality, integrity, and availability.

What happened

SAP disclosed CVE-2026-109795 for S4CRM 204, 205, and 206, S4CEXT 107, 108, and 109, and BBPCRM 713 and 714. Certain remote-enabled functionality does not perform necessary authorization checks and lacks sufficient input validation (CWE-94), so a low-privileged attacker can send specially crafted input through a remote interface to inject and execute arbitrary code. SAP says successful exploitation could extend the attacker’s reach beyond the vulnerable component, with high impact on confidentiality, integrity, and availability. SAP scores it 9.9.

Apply SAP note 3834842 through the normal SAP patch process; this advisory does not name a fixed version beyond the note.

What to do

  1. Inventory every S4CRM deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix exactly as directed in the linked SAP security note.
  3. Restrict network access to S4CRM while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for remote-enabled function calls from low-privilege users and unexpected code execution.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

A low-privilege account is enough here, so assume any authenticated S4CRM user could reach this. Patch, and treat the remote interface as exposed until the note is applied.