SAP ERP/S/4HANA Flaw Exposes ABAP Reports to Unauthorized Overwrites

A critical vulnerability, tracked as CVE-2026-34256, has surfaced in SAP ERP and SAP S/4HANA (both Private Cloud and On-Premise deployments). According to the National Vulnerability Database, this flaw stems from a missing authorization check, allowing an authenticated attacker to execute a specific ABAP report. The kicker? This report can overwrite any existing eight-character executable ABAP report without proper authorization.

While the integrity impact is limited to the affected report and confidentiality remains untouched, the potential for disruption is significant. If an overwritten report is subsequently executed, its intended functionality goes belly-up. The National Vulnerability Database has slapped a CVSS score of 7.1 (HIGH) on this, driven by its network attack vector and high availability impact. This is a classic CWE-862 scenario – missing authorization checks are a persistent pain point, and in an environment as complex as SAP, they can lead to some serious headaches for ops teams.