CVE-2026-40129: The ABAP Code Injection Flaw That Needs Your Immediate Attention

Sara Kim breaks down what you need to know

I’ve been staring at SAP Security Note 3735359 for the last hour, and my developer spidey‑sense is screaming. This isn’t the usual buffer overflow or a tame cross‑site scripting patch you can schedule for next quarter. We’re talking about code injection on the ABAP application server itself – the kind of vulnerability that can turn a carefully crafted HTTP request or an RFC call into a full system takeover.

In my consulting work, I’ve helped teams recover from exactly these scenarios. Sometimes the injection surfaced through a poorly written custom handler in SICF, sometimes it came via an internal RFC interface that nobody thought to lock down. The common thread? Nobody realized that ABAP’s dynamic programming features could become a launchpad for an attacker until it was too late.

The Real Story

The CVE-2026-40129 advisory describes a code injection vulnerability in SAP Application Server ABAP, affecting both SAP NetWeaver and the ABAP Platform component. SAP has classified it with a high severity, and from the limited details, the root cause appears to involve improper validation of input that is subsequently used in dynamic ABAP code generation.

Think about what that means day‑to‑day. ABAP has several mechanisms to build and execute code at runtime:

• Dynamic OPEN SQL (for example, SELECT * FROM (lv_table))
• GENERATE SUBROUTINE POOL using code fragments assembled from strings
• CALL TRANSACTION with runtime‑built batch input
• Inline ABAP execution in certain development utilities or custom engines

If an external entity – a manipulated HTTP request, a poisoned RFC parameter, or a compromised file upload – can feed unchecked data into one of these dynamic statements, you have a recipe for disaster. The attacker doesn’t need access to SE38; they just need a path where their string becomes executable ABAP.

A typical vulnerable pattern I’ve seen too often in real code:

DATA(lv_query) = `SELECT * FROM ` && lv_table_input.
lv_query = lv_query && ` WHERE mandt = sy-mandt`.
DATA(lv_result) = lv_query->*( … ).

If lv_table_input contains something like dbtab; DELETE FROM users --, you’ve just handed the attacker a loaded gun. And yes, that’s ABAP injection. It doesn’t get talked about as often as SQL injection, but the consequences are even more severe because you’re executing inside the application server kernel with all its privileges.

What This Means for You

If you’re a Basis administrator, your immediate job is to plan the emergency patching of SAP Note 3735359. This note will deliver corrections likely in the kernel or in ABAP runtime patches, so you need to align with your OS/DB teams for an out‑of‑cycle maintenance window. Do not wait for the next regular patch cycle if your landscape has any ABAP system directly reachable from the internet, or even from a loosely controlled internal network.

If you’re an ABAP developer or architect, your role is twofold. First, help assess exposure: which programs, RFC modules, or gateway services dynamically construct and execute ABAP code? Run your ABAP Test Cockpit (ATC) with the security checks profile, or fire up open‑source tools like abapOpenChecks with the “dynamic programming” ruleset activated. I keep a custom checklist for quick health scans:

• All ICF services that process request parameters and call code‑generating APIs
• RFC function modules with DESTINATION parameters that might be manipulated
• Any batch processing where file input goes into GENERATE SUBROUTINE POOL
• Direct use of SYNTAX-CHECK or RUN statements with user‑supplied fragments

Second, start hardening those patterns now. Even after patching, defense in depth matters. Use CL_ABAP_DYN_PRG methods to sanitize inputs, or strictly validate table/field names against whitelists. The patch closes the specific CVE, but your own dynamic code might have similar weaknesses that won’t be caught.

Action Items

Here’s what I’m

References

• SAP Security Patch Day - May 2026
• SAP Security Notes & News
• ABAP Development Guide