This vulnerability arises from a missing authorization check in SAP ERP and SAP S/4HANA systems, allowing an authenticated attacker to overwrite executable ABAP reports of eight characters in length without authorization. The overwritten reports, when executed, may cause the intended functionality to become unavailable, impacting availability. The integrity impact is limited to the specific overwritten report, and confidentiality remains unaffected. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. Affected versions include multiple SAP_FIN, SAPSCORE, S4CORE, and EA-APPL releases. No patch or official remediation level has been disclosed as of the published date.

Successful exploitation allows an authenticated attacker to overwrite executable ABAP reports without authorization, causing denial of service or disruption of intended report functionality (availability impact). Integrity impact is limited to the affected ABAP report, with no confidentiality impact. This could disrupt business processes relying on these reports but does not expose sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ABAP report execution to trusted and authorized users only, and monitor for unauthorized report modifications. Follow SAP's security recommendations once a vendor advisory is published.