CVE-2026-44744
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SAP S/4HANA (On-Premise) has an SQL injection vulnerability in a remote-enabled function module. An authenticated attacker can execute unauthorized database queries, exposing sensitive information.
Risk Assessment
An attacker can read confidential data from the database, with high impact on confidentiality, no impact on integrity or availability.
Recommendation
Immediately apply security patches from SAP for SAP S/4HANA.
Other vulnerabilities in SAP S/4HANA
See all- CVE-2026-0498Critical
Vulnerability in SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to inject arbitrary ABAP code or OS commands via the RFC-exposed function module, bypassing authorization checks.
- CVE-2026-66766High
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.
- CVE-2026-66764Medium
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.
- CVE-2026-44771Medium
In SAP S/4HANA, the Draft operation does not perform necessary authorization checks for an authenticated user. A restricted user could access information within the entity, resulting in escalation of privileges.
- CVE-2026-44769Medium
A vulnerability in SAP S/4HANA Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability.
Original NVD description (English source)
SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an authenticated attacker to potentially execute unauthorized database queries.This flaw exposes sensitive information to which they should not otherwise have access to. The vulnerability has a high impact on the confidentiality of the data with no impact on the integrity and availability of the application.