---
id: "CVE-2026-120009"
page: "https://infrastack.ai/live/CVE-2026-120009"
kind: "vulnerability"
aliases: ["CVE-2026-120009"]
title: "SAP ABAP Developer Tools: AMDP Data Preview lets high-privilege users run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP ABAP Developer Tools (AMDP Data Preview)", "fixed": [], "affected": "SAP_BASIS 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920 (from CVE List V5 mirror, not SAP note)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["abap", "authenticated", "code-injection", "sap", "sap-netweaver", "vendor"]
not_affected_if: ["no-abap-developer-tools", "restricted-developer-privileges"]
published_at: "2026-11-10T01:17:16+00:00"
first_seen_at: "2026-11-10T01:26:39+00:00"
updated_at: "2026-11-10T01:35:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120009", "first_seen_at": "2026-11-10T01:26:39+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120009", "first_seen_at": "2026-11-10T01:35:03+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-120009", "https://hol.org/guard/security/cves/CVE-2026-120009-code-injection-vulnerability-in-sap-abap"]}]
exploit_sources: []
---

# SAP ABAP Developer Tools: AMDP Data Preview lets high-privilege users run code

Link for people: https://infrastack.ai/live/CVE-2026-120009 (this .md is for agents)

SAP ABAP Developer Tools' AMDP Data Preview feature does not sufficiently validate input or check authorization in certain functions. An attacker with high privileges can submit crafted input to execute arbitrary code and fully compromise the affected SAP system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP ABAP Developer Tools (AMDP Data Preview) affected SAP_BASIS 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 920 (from CVE List V5 mirror, not SAP note) fixed no fixed version listed

## How to check

In SAP for Me, open Security Note 3833364 (cited by the CVE record) and check whether your SAP_BASIS release (740, 750-758, 816 or 920 per the CVE feed) is in scope, then use SNOTE to see if the note is implemented. Also check who holds developer/ADT authorizations that reach AMDP Data Preview. Whether the feature is on by default is unknown: the note is behind SAP login and was not read.

## Timeline

- 2026-11-10T01:26:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120009
- 2026-11-10T01:35:03+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-120009 — Published on Nov 2026 SAP Patch Day. Primary source is SAP Security Note 3833364 (me.sap.com, login required, not readable). Affected SAP_BASIS list is from a CVE List V5 mirror (hol.org), fix versions and default-on status unknown. CWE-94, CVSS 7.2 PR:H. No exploitation or PoC found. Nothing verified. Settle by reading note 3833364 or the SAP November 2026 patch day page.

## Documents

- [describes] NVD: CVE-2026-120009 https://nvd.nist.gov/vuln/detail/CVE-2026-120009
- [mentions] HOL Guard record for CVE-2026-120009 (mirrors CVE List V5 data) https://hol.org/guard/security/cves/CVE-2026-120009-code-injection-vulnerability-in-sap-abap

## From the sources

SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on the system. Successful exploitation could allow the attacker to fully compromise the system, resulting in a high impact on confidentiality, integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_