SAP patched a code injection bug in CRM and S/4HANA scoring 9.9 on severity. Authenticated attackers can run arbitrary SQL statements and potentially compromise entire databases. The kind of vulnerability that makes security teams drop everything and patch immediately.