SQL Injection Vulnerability in SAP S/4HANA On-Premise Products
CVE-2026-44744

6.5MEDIUM

Key Information:

Vendor

SAP
Status
SAP S/4hana
Vendor
CVE Published:
9 June 2026

What is CVE-2026-44744?

The SAP S/4HANA On-Premise product has introduced a vulnerability in a remote-enabled function module, allowing authenticated attackers to exploit SQL injection flaws. By manipulating input, attackers could execute unauthorized database queries, potentially exposing sensitive information that should remain protected. While this vulnerability significantly impacts data confidentiality, it does not affect the application's integrity or availability.

Affected Version(s)

SAP S/4HANA S4FND 102

SAP S/4HANA 103

SAP S/4HANA 104

References

https://me.sap.com/notes/3751691
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.