Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-34260— SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)

CVSS 9.6 · Critical EPSS 0.01% · P2

Affected Version Matrix 9

VendorProductVersion RangeStatus
SAP_SESAP S/4HANA (SAP Enterprise Search for ABAP)SAP_BASIS 751affected
SAP_BASIS 752affected
SAP_BASIS 753affected
SAP_BASIS 754affected
SAP_BASIS 755affected
SAP_BASIS 756affected
SAP_BASIS 757affected
SAP_BASIS 758affected
… +1 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-34260

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
Source: NVD (National Vulnerability Database)
Vulnerability Description
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP S/4HANA SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP S/4HANA是德国思爱普（SAP）公司的一个基于 SAP HANA 内存数据库系统的的企业资源管理软件。 SAP S/4HANA存在SQL注入漏洞，该漏洞源于SQL注入漏洞，可能导致经过身份验证的攻击者通过用户控制的输入注入恶意SQL语句，从而未经授权访问敏感数据库信息并可能导致应用程序崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SAP_SESAP S/4HANA (SAP Enterprise Search for ABAP) SAP_BASIS 751 -

II. Public POCs for CVE-2026-34260

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-34260

请登录查看更多情报信息。

Same Patch Batch · SAP_SE · 2026-05-12 · 14 CVEs total

CVE-2026-342639.6 CRITICALMissing authentication check in SAP Commerce cloud configuration
CVE-2026-342598.2 HIGHOS Command Injection Vulnerability in SAP Forecasting & Replenishment
CVE-2026-401356.5 MEDIUMOS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP P
CVE-2026-401336.3 MEDIUMMissing Authorization check in SAP S/4HANA Condition Maintenance
CVE-2026-401376.1 MEDIUMCross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUN
CVE-2026-05025.4 MEDIUMCross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform
CVE-2026-401325.4 MEDIUMMissing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanc
CVE-2026-276824.7 MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABA
CVE-2026-342584.7 MEDIUMContent Spoofing vulnerability in SAPUI5 (Search UI)
CVE-2026-401364.3 MEDIUMDenial of service (DoS) in SAP Financial Consolidation
CVE-2026-401294.3 MEDIUMCode Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Pla
CVE-2026-401344.3 MEDIUMMissing Authorization Check in SAP Incentive and Commission Management
CVE-2026-401313.4 LOWSQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library

IV. Related Vulnerabilities

Same vendor: SAP_SE
Same weakness: CWE-89

V. Comments for CVE-2026-34260

No comments yet

Leave a comment