Quick answers
- Is CVE-2026-44744 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44744 being exploited in the wild.
- How severe is CVE-2026-44744?
- Medium severity, with a CVSS score of 6.5, published 9 June 2026.
- Which products and versions are affected?
- SAP S/4HANA (On-Premise).
- Is there a fix for CVE-2026-44744?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-44744 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44744?
- Check whether you run SAP S/4HANA. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An SQL injection vulnerability (CWE-89) exists within a remote-enabled function module (RFM) in SAP S/4HANA (On-Premise). The flaw is caused by improper neutralization of special elements used in SQL commands, allowing an authenticated attacker with low privileges to bypass intended access controls. By sending crafted inputs to the affected module over the network, an attacker can execute arbitrary SQL queries against the backend database. This exploit primarily impacts data confidentiality, enabling unauthorized read access to sensitive records, though it does not provide a mechanism for data modification (integrity) or service disruption (availability). SAP has released security note 3751691 to address this issue.
Affected products
- SAP S/4HANA (On-Premise)
Timeline
- 2026-06-09: advisory: SAP Security Patch Day release
- 2026-06-09: disclosed: NVD publication date