This vulnerability (CVE-2026-34259) in SAP Forecasting & Replenishment arises from improper neutralization of special elements in OS command execution (CWE-77). It allows an authenticated attacker with administrative rights to abuse a function that is not remote-enabled to execute arbitrary OS commands. The affected SAP product versions include SCM 702, 712, 713, and 714. The CVSS v3.1 base score is 8.2, reflecting high impact on confidentiality, integrity, and availability. The vendor has published the vulnerability but has not yet provided a remediation or patch. The vulnerability requires local authentication with high privileges and no user interaction.

Successful exploitation can result in complete system compromise, including unauthorized reading or modification of any system data and potential system shutdown. This impacts confidentiality, integrity, and availability of the affected SAP system. The attack requires administrative privileges and local access, limiting the attack surface to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to the affected SAP Forecasting & Replenishment versions. Avoid using the vulnerable function if possible. Follow SAP security best practices for privilege management.