CVE-2026-34260: SAP S/4HANA SQL Injection Vulnerability

CVE-2026-34260 Overview

CVE-2026-34260 is a SQL injection vulnerability in SAP S/4HANA, specifically within the SAP Enterprise Search for ABAP component. The application concatenates user-controlled input directly into SQL queries without validation or sanitization. An authenticated attacker with low privileges can inject malicious SQL statements that reach the underlying database. Successful exploitation grants unauthorized access to sensitive database records and can crash the application. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers can extract confidential business data from SAP S/4HANA databases and trigger denial-of-service conditions across enterprise resource planning workloads.

Affected Products

• SAP S/4HANA
• SAP Enterprise Search for ABAP component
• SAP NetWeaver ABAP-based deployments hosting the affected component

Discovery Timeline

• 2026-05-12 - CVE-2026-34260 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-34260

Vulnerability Analysis

The vulnerability resides in SAP Enterprise Search for ABAP, a component embedded in SAP S/4HANA that enables federated search across business objects. The component accepts search parameters from authenticated users and forwards them to backend ABAP code that constructs Open SQL or native SQL queries. Instead of using parameterized statements or escape routines such as CL_ABAP_DYN_PRG, the affected code path concatenates the raw input into the query string.

An attacker supplies crafted input containing SQL metacharacters and additional clauses. The database executes the resulting statement with the privileges of the application service user, which typically holds broad read access across SAP tables. Confidentiality and availability impacts are rated high, while integrity is unaffected because the injection path does not enable write operations.

Root Cause

The root cause is missing input sanitization in the search query construction logic. Dynamic SQL is built through string concatenation rather than bind variables, violating standard ABAP secure coding guidance for handling external input.

Attack Vector

Exploitation requires network access to the SAP S/4HANA application server and valid user credentials with permission to invoke the Enterprise Search interface. The scope is changed, meaning the injected query can affect database content beyond the search component's own authorization boundary. No user interaction is required.

The vulnerability is exploited in prose terms by submitting a search request where a parameter such as a query term or filter value contains appended SQL syntax. The backend concatenates the value into a SELECT statement, allowing the attacker to break out of the intended clause and append UNION SELECT constructs or comment terminators that expose arbitrary table contents.

Detection Methods for CVE-2026-34260

Indicators of Compromise

• HTTP requests to SAP Enterprise Search endpoints containing SQL metacharacters such as single quotes, --, UNION, or ; in query parameters
• Unexpected ABAP runtime errors (DBSQL_* short dumps) generated by the Enterprise Search service in transaction ST22
• Database audit log entries showing search service users executing queries against tables outside the search index scope
• Spikes in failed or malformed search requests from a single authenticated session

Detection Strategies

• Enable SAP Read Access Logging (RAL) and UI logging for the Enterprise Search service to capture parameter values submitted by users
• Inspect SAP Security Audit Log (transaction SM19/SM20) for anomalous query patterns originating from low-privilege accounts
• Deploy web application firewall rules on the SAP Web Dispatcher to flag SQL injection signatures in search request bodies

Monitoring Recommendations

• Correlate authentication events with Enterprise Search activity in a SIEM to identify accounts probing search endpoints after login
• Monitor database short dumps and connection drops that may indicate denial-of-service attempts against the application tier
• Baseline normal search query volume per user and alert on deviations consistent with automated injection tooling

How to Mitigate CVE-2026-34260

Immediate Actions Required

• Apply the corrections delivered in SAP Note #3724838 on all SAP S/4HANA systems running Enterprise Search for ABAP
• Review the May 2026 SAP Security Patch Day bulletin for related fixes and prerequisites
• Restrict authorization object access for the Enterprise Search service to users with a documented business need
• Rotate credentials for any account suspected of submitting malicious search requests prior to patching

Patch Information

SAP released the official fix in SAP Note #3724838. The note contains the support package and kernel prerequisites required to deploy the correction across affected S/4HANA releases. Apply the patch through the SAP Note Assistant (transaction SNOTE) or as part of the next support package stack update. Confirm the correction is active by validating the component version in transaction SPAM after deployment.

Workarounds

• Disable or restrict access to the Enterprise Search for ABAP service through role and authorization object adjustments until patching is complete
• Place SAP Web Dispatcher or an upstream WAF in front of the application server with signatures that block SQL injection payloads targeting search endpoints
• Increase SAP Security Audit Log verbosity for affected services to enable rapid forensic analysis if exploitation is suspected

# Apply the SAP Note via SNOTE transaction
# 1. Log in to the SAP GUI with administrative privileges
# 2. Execute transaction SNOTE
# 3. Download SAP Note 3724838 from the SAP Support Portal
# 4. Implement the note and run prerequisite checks
# 5. Validate using transaction SPAM after import