important · Edge — SAP Cluster
An unauthenticated SAP Message Server caller can become a trusted cluster node and execute code across every application server.
Affects
SAP NetWeaver Message Server on ABAP systems using affected 9.x kernels, including S/4HANA and S/4HANA Cloud Private Edition deployments.
A crafted registration packet sent to public port 36NN makes the Message Server trust an attacker-controlled address as an internal application-server component.
Detail and 2 sources
That trust propagates across the cluster, allowing the attacker to reach SAP Gateways, invoke RFC-callable external programs and execute commands as the SAP operating-system administrator.