Brief Summary: CVE-2026-34260 SQL Injection in SAP S/4HANA Enterprise Search for ABAP (CVSS 9.6)

Introduction

An authenticated SQL injection in SAP S/4HANA's Enterprise Search for ABAP component lets a low-privilege user extract sensitive database contents and crash the application. It carries a CVSS score of 9.6. Nine versions of SAP BASIS are affected, and SAP environments routinely hold financial, HR, and supply-chain data, so unpatched S/4HANA deployments are a significant exposure for the organizations running them.

Technical Information

The root cause of CVE-2026-34260 is a classic CWE-89 flaw: improper neutralization of special elements used in an SQL command. The SAP Enterprise Search for ABAP component accepts user-controlled input and concatenates it directly into SQL queries before passing them to the underlying database. Nothing parameterizes, escapes, or validates that input where the query is built.

The CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H, which means:

• The attack works over the network and does not require local or adjacent network access.
• Only low privileges are required. Any authenticated user with minimal authorization can attempt exploitation.
• The scope is changed. The vulnerability in the Enterprise Search component can affect resources beyond its own security boundary, which is what pushes the score to 9.6.
• Confidentiality and availability are both rated high, and integrity is unaffected. The attacker can read data and disrupt service but cannot modify database contents through this vector.

Attack Flow

1. An attacker authenticates to the SAP S/4HANA system with a low-privilege account.
2. The attacker navigates to the Enterprise Search interface, whose search functionality is backed by ABAP code that constructs SQL queries.
3. The attacker supplies crafted input containing SQL injection payloads in one or more search fields.
4. The application concatenates this input directly into a SQL statement without sanitization.
5. The database executes the manipulated query with the privileges of the application's database connection.
6. Depending on the injected payload, the attacker can enumerate database tables, extract sensitive records (high confidentiality impact), or trigger conditions that crash the application (high availability impact).

Because the scope is changed, the impact extends beyond the Enterprise Search component itself. The attacker effectively gains a channel to interact with the broader database layer.

Affected Systems and Versions

The vulnerability affects the SAP Enterprise Search for ABAP component in the following SAP BASIS versions within SAP S/4HANA:

Organizations should inventory their SAP environments to find out whether any of these SAP BASIS versions are deployed.

Vendor Security History

SAP releases security patches monthly and has a track record of fixing SQL injection and authorization flaws in its ABAP stack. On the April 2026 Patch Day, SAP resolved a separate CVSS 9.9 SQL injection vulnerability in SAP Business Planning and Consolidation, another ABAP-based component. Critical SQL injection findings keep recurring in ABAP components. That suggests legacy code paths in the ABAP stack still carry injection risk, and that organizations relying on SAP should treat each monthly Patch Day as a priority.

References

• NVD: CVE-2026-34260
• CVE Record: CVE-2026-34260
• SAP Note 3724838 (SAP for Me)
• SAP Security Patch Day
• SAP Patches Critical ABAP Vulnerability (SecurityWeek)
• SAP Patch Day April 2026: Critical SQL Injection and Authorization Flaws (Pathlock)
• SAP Q1 2026 Quarterly Statement
• CISA Adds Eight Known Exploited Vulnerabilities to Catalog (April 2026)
• CISA Adds Five Known Exploited Vulnerabilities to Catalog (March 2026)