{"id":"CVE-2026-120009","kind":"vulnerability","aliases":["CVE-2026-120009"],"related":[],"title":"SAP ABAP Developer Tools: AMDP Data Preview lets high-privilege users run code","description":"SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability.","summary":"SAP ABAP Developer Tools' AMDP Data Preview feature does not sufficiently validate input or check authorization in certain functions. An attacker with high privileges can submit crafted input to execute arbitrary code and fully compromise the affected SAP system.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP ABAP Developer Tools (AMDP Data Preview)","fixed":[],"affected":"SAP_BASIS 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920 (from CVE List V5 mirror, not SAP note)","ecosystem":"vendor"}],"ecosystems":[],"tags":["abap","authenticated","code-injection","sap","sap-netweaver","vendor"],"not_affected_if":["no-abap-developer-tools","restricted-developer-privileges"],"how_to_check":"In SAP for Me, open Security Note 3833364 (cited by the CVE record) and check whether your SAP_BASIS release (740, 750-758, 816 or 920 per the CVE feed) is in scope, then use SNOTE to see if the note is implemented. Also check who holds developer/ADT authorizations that reach AMDP Data Preview. Whether the feature is on by default is unknown: the note is behind SAP login and was not read.","fix":null,"status":"open","published_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","triaged_at":"2026-11-10T01:28:42+00:00","updated_at":"2026-11-10T01:35:03+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:28:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP ABAP Developer Tools: AMDP Data Preview lets high-privilege users run code","impact":"high","summary":"SAP ABAP Developer Tools' AMDP Data Preview feature does not sufficiently validate input or check authorization in certain functions. An attacker with high privileges can submit crafted input to execute arbitrary code and fully compromise the affected SAP system.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","abap","sap-netweaver"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the SAP system; full system compromise","analyst_note":"Find the SAP Security Note and affected version ranges for AMDP Data Preview, and check whether the feature is on by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-abap-developer-tools"],"who_is_affected":"Organizations running SAP systems with ABAP Developer Tools and the AMDP Data Preview feature. The sources do not name affected SAP product versions or say whether the feature must be enabled. Attackers need high privileges, so teams restricting developer privileges face less exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4585,"output_tokens":478,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the SAP Security Note and affected version ranges for AMDP Data Preview, and check whether the feature is on by default.","search":"'-120009':17A,20A '-2026':16A,19A 'abap':2A,22A,28B,39B,78C 'affect':74B,94C 'allow':118C 'amdp':5A,25A,42B,81C 'arbitrari':68B,110C 'attack':58B,97C,120C 'authent':29B 'author':53B,90C 'avail':135C 'certain':55B,93C 'check':52B,91C 'code':14A,31B,69B,111C 'code-inject':30B 'compromis':72B,123C 'confidenti':132C 'could':101C,117C 'craft':64B,104C 'cve':15A,18A 'data':6A,26A,43B,82C 'develop':3A,40B,79C 'developer':23A 'execut':67B,109C 'exploit':116C 'featur':45B 'fulli':71B,122C 'function':56B,95C 'high':10A,60B,99C,129C 'high-privileg':9A 'impact':130C 'inject':32B,107C 'input':50B,65B,105C 'integr':133C 'let':8A 'netweav':36B 'perform':86C 'preview':7A,27A,44B,83C 'privileg':11A,61B,100C 'result':126C 'run':13A 'sap':1A,21A,33B,35B,38B,75B,77C 'sap-netweav':34B 'special':103C 'submit':63B,102C 'success':115C 'suffici':48B,87C 'system':76B,114C,125C 'tool':4A,41B,80C 'tools':24A 'user':12A 'valid':49B,88C 'vendor':37B 'within':92C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP systems with ABAP Developer Tools and the AMDP Data Preview feature. The sources do not name affected SAP product versions or say whether the feature must be enabled. Attackers need high privileges, so teams restricting developer privileges face less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["abapdevelopertoolsamdpdatapreview","sapabapdevelopertoolsamdpdatapreview"],"ptokens":["abap","amdp","data","developer","preview","sap","tools"],"labels":["abap","authenticated","codeinjection","high","sap","sapnetweaver","vendor"],"campaign_type":null,"search_a":"'-120009':17A,20A '-2026':16A,19A 'abap':2A,22A 'amdp':5A,25A 'code':14A 'cve':15A,18A 'data':6A,26A 'develop':3A 'developer':23A 'high':10A 'high-privileg':9A 'let':8A 'preview':7A,27A 'privileg':11A 'run':13A 'sap':1A,21A 'tool':4A 'tools':24A 'user':12A","search_b":"'abap':28B,39B 'affect':74B 'amdp':42B 'arbitrari':68B 'attack':58B 'authent':29B 'author':53B 'certain':55B 'check':52B 'code':31B,69B 'code-inject':30B 'compromis':72B 'craft':64B 'data':43B 'develop':40B 'execut':67B 'featur':45B 'fulli':71B 'function':56B 'high':60B 'inject':32B 'input':50B,65B 'netweav':36B 'preview':44B 'privileg':61B 'sap':33B,35B,38B,75B 'sap-netweav':34B 'submit':63B 'suffici':48B 'system':76B 'tool':41B 'valid':49B 'vendor':37B","search_c":"'abap':78C 'affect':94C 'allow':118C 'amdp':81C 'arbitrari':110C 'attack':97C,120C 'author':90C 'avail':135C 'certain':93C 'check':91C 'code':111C 'compromis':123C 'confidenti':132C 'could':101C,117C 'craft':104C 'data':82C 'develop':79C 'execut':109C 'exploit':116C 'fulli':122C 'function':95C 'high':99C,129C 'impact':130C 'inject':107C 'input':105C 'integr':133C 'perform':86C 'preview':83C 'privileg':100C 'result':126C 'sap':77C 'special':103C 'submit':102C 'success':115C 'suffici':87C 'system':114C,125C 'tool':80C 'valid':88C 'within':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120009","severity":null,"published_at":"2026-11-10T01:17:16+00:00","modified_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","fetched_at":"2026-11-10T01:26:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120009:2387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120009","severity":null,"published_at":"2026-11-10T01:35:03+00:00","modified_at":"2026-11-10T01:35:03+00:00","first_seen_at":"2026-11-10T01:35:03+00:00","fetched_at":"2026-11-10T01:35:03+00:00","note":"Published on Nov 2026 SAP Patch Day. Primary source is SAP Security Note 3833364 (me.sap.com, login required, not readable). Affected SAP_BASIS list is from a CVE List V5 mirror (hol.org), fix versions and default-on status unknown. CWE-94, CVSS 7.2 PR:H. No exploitation or PoC found. Nothing verified. Settle by reading note 3833364 or the SAP November 2026 patch day page.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-120009","https://hol.org/guard/security/cves/CVE-2026-120009-code-injection-vulnerability-in-sap-abap"]}],"documents":[{"id":112468,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120009","title":"NVD: CVE-2026-120009","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112469,"url":"https://hol.org/guard/security/cves/CVE-2026-120009-code-injection-vulnerability-in-sap-abap","title":"HOL Guard record for CVE-2026-120009 (mirrors CVE List V5 data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}