This vulnerability arises from a missing authorization check in SAP ERP and SAP S/4HANA systems, allowing an authenticated user to execute a specific ABAP report that overwrites any existing eight-character executable ABAP report without authorization. The overwritten report, when executed, may cause the intended functionality to become unavailable, impacting system availability. The vulnerability affects multiple versions of SAP_FIN, SAPSCORE, S4CORE, and EA-APPL components. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Successful exploitation results in denial of service by overwriting executable ABAP reports, rendering their intended functionality unavailable. Integrity impact is limited to the specific overwritten report, and confidentiality is not affected. The vulnerability requires authenticated access with privileges to execute the specific ABAP report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to the affected ABAP reports and monitor for unauthorized execution attempts. Follow SAP's official advisories for updates.