SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-120009
Code injection in SAP ABAP Developer Tools (AMDP Data Preview)
- CVSS 3.1
- 7.2 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SAP ABAP Developer Tools (AMDP Data Preview) does not sufficiently validate input or check authorization in certain functionality. A remote attacker who already has high privileges can send crafted input that injects and runs arbitrary code, with no user interaction required. Successful exploitation can fully compromise the system, affecting confidentiality, integrity, and availability.
What to do: Apply SAP's update for CVE-2026-120009. SAP has not listed a fixed version or workaround.
| Product | Affected |
|---|---|
| SAP ABAP Developer Tools (AMDP Data Preview) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability.
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H