CVE-2026-44744

SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an authenticated attacker to potentially execute unauthorized database queries.This flaw exposes sensitive information to which they should not otherwise have access to. The vulnerability has a high impact on the confidentiality of the data with no impact on the integrity and availability of the application.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3751691
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) SAP S/4HANA (On-Premise) contiene una vulnerabilidad de inyección SQL en un componente de módulo de función habilitado remotamente que podría ser explotada por un atacante autenticado para ejecutar potencialmente consultas de base de datos no autorizadas. Esta falla expone información sensible a la que de otro modo no deberían tener acceso. La vulnerabilidad tiene un alto impacto en la confidencialidad de los datos sin impacto en la integridad y disponibilidad de la aplicación.

09 Jun 2026, 01:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 01:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-44744

Mitre link : CVE-2026-44744

CVE.ORG link : CVE-2026-44744

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-44744", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44744", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T13:21:24.297153Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP S/4HANA", "versions": [{"status": "affected", "version": "S4FND 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T01:16:46.333", "references": [{"url": "https://me.sap.com/notes/3751691", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an authenticated attacker to potentially execute unauthorized database queries.This flaw exposes sensitive information to which they should not otherwise have access to. The vulnerability has a high impact on the confidentiality of the data with no impact on the integrity and availability of the application."}, {"lang": "es", "value": "SAP S/4HANA (On-Premise) contiene una vulnerabilidad de inyecci\u00f3n SQL en un componente de m\u00f3dulo de funci\u00f3n habilitado remotamente que podr\u00eda ser explotada por un atacante autenticado para ejecutar potencialmente consultas de base de datos no autorizadas. Esta falla expone informaci\u00f3n sensible a la que de otro modo no deber\u00edan tener acceso. La vulnerabilidad tiene un alto impacto en la confidencialidad de los datos sin impacto en la integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "cna@sap.com"}