SAP ABAP DEVELOPER TOOLS (AMDP DATA PREVIEW) · CVE-2026-120009 · Vendor
NO FIX YET
SAP ABAP Developer Tools' AMDP Data Preview feature does not sufficiently validate input or check authorization in certain functions. An attacker with high privileges can submit crafted input to execute arbitrary code and fully compromise the affected SAP system.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP systems with ABAP Developer Tools and the AMDP Data Preview feature. The sources do not name affected SAP product versions or say whether the feature must be enabled. Attackers need high privileges, so teams restricting developer privileges face less exposure.
Not affected if no-abap-developer-tools, restricted-developer-privileges
Who cares abap, authenticated, code-injection, sap, sap-netweaver
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.