This vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89) within SAP S/4HANA's Enterprise Search for ABAP component. The application concatenates user input directly into SQL queries, enabling an authenticated attacker to perform SQL injection attacks. The vulnerability affects SAP_BASIS versions 751 through 758 and 816. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and availability. No known exploits are reported in the wild, and no patch or official remediation level has been disclosed.

Exploitation allows an authenticated attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized access to sensitive data and denial of service via application crashes. Confidentiality and availability are severely impacted, while data integrity is not affected. The vulnerability poses a critical risk to affected SAP S/4HANA environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected SAP S/4HANA components to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable interface to untrusted networks. Follow SAP's security recommendations once available.