PT-2026-39921 · Sap · Sap S/4Hana

Published 2026-05-12 · Updated 2026-05-18 · CVE-2026-34260

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP S/4HANA (SAP Enterprise Search for ABAP) (affected versions not specified)

Description An authenticated attacker can inject malicious SQL statements through user-controlled input. The application directly concatenates this input into SQL queries and passes them to the underlying database without proper validation or sanitization. Successful exploitation may allow unauthorized access to sensitive database information and could potentially crash the application, impacting confidentiality and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-06726

CVE-2026-34260

Affected Products

Sap S/4Hana

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2026-34260 · Security Note
• https://bdu.fstec.ru/vul/2026-06726 · Security Note
• https://reddit.com/r/pwnhub/comments/1tgnuvb/critical_security_flaws_found_in_ivanti_fortinet · Reddit Post
• https://t.me/CVEtracker/53448 · Telegram Post
• https://twitter.com/OrizonCyber/status/2054041420684488992 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2054485865615720810 · Twitter Post
• https://twitter.com/abokfelix/status/2054790838329242083 · Twitter Post
• https://me.sap.com/notes/3724838 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2026.html · Note
• https://twitter.com/abokfelix/status/2054790840929644931 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://undercodetesting.com/critical-sap-s-4hana-sql-injection-under-active-patching-cve-2026-34260-cvss-96-what-undercode-say-video · Note
• https://twitter.com/VulmonFeeds/status/2054128099118215652 · Twitter Post
• https://twitter.com/ToolsLib/status/2054862918101963005 · Twitter Post
• https://twitter.com/CCBalert/status/2054494865451270352 · Twitter Post