CVE-2026-44751
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.
Risk Assessment
An authenticated attacker can modify other users' data, potentially leading to data integrity breaches and privilege escalation within the application.
Recommendation
Apply the security patches provided by the ABAP server vendor.
Other vulnerabilities in Application server ABAP
See all- CVE-2026-0506High
A Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow writing or modifying data accessible via FORMs and invoking system functionality, resulting in high impact on integrity and availability, while confidentiality remains unaffected.
- CVE-2025-42904Medium
An Information Disclosure vulnerability in Application Server ABAP allows an authenticated attacker to read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.
Original NVD description (English source)
Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS