CVE-2026-34259 — OS Command Injection Vulnerability in SAP Forecasting & Replenishment

CVE-2026-34259

OS Command Injection Vulnerability in SAP Forecasting & Replenishment PUBLISHED

Description (CNA)

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Forecasting & Replenishment	affected SCM 702; affected 712; affected 713; affected 714

CWE

CWE-77

References

https://me.sap.com/notes/3732471
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.