# CVE-2026-44744: SAP S/4HANA SQL injection in remote-enabled function module

Source: https://junglewise.ai/threats/cve-2026-44744-sap-s-4hana-sql-injection-in-remote-enabled-function-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44744 · Severity: medium · CVSS 6.5 · Published 2026-06-09

SAP S/4HANA, a comprehensive enterprise resource planning suite, contains a security flaw in one of its internal communication modules. An authorized user with basic access could exploit this vulnerability to run unauthorized database queries and view sensitive business information. While this does not allow an attacker to delete data or crash the system, it poses a significant risk to data privacy and confidentiality.

Technologies: [SAP S/4HANA](https://junglewise.ai/threats/technologies/s-4hana). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-44744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44744 being exploited in the wild.

**How severe is CVE-2026-44744?** Medium severity, with a CVSS score of 6.5, published 9 June 2026.

**Which products and versions are affected?** SAP S/4HANA (On-Premise).

**Is there a fix for CVE-2026-44744?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44744 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44744?** Check whether you run SAP S/4HANA. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability (CWE-89) exists within a remote-enabled function module (RFM) in SAP S/4HANA (On-Premise). The flaw is caused by improper neutralization of special elements used in SQL commands, allowing an authenticated attacker with low privileges to bypass intended access controls. By sending crafted inputs to the affected module over the network, an attacker can execute arbitrary SQL queries against the backend database. This exploit primarily impacts data confidentiality, enabling unauthorized read access to sensitive records, though it does not provide a mechanism for data modification (integrity) or service disruption (availability). SAP has released security note 3751691 to address this issue.

## Affected products

- SAP S/4HANA (On-Premise)

## Timeline

- 2026-06-09: advisory: SAP Security Patch Day release
- 2026-06-09: disclosed: NVD publication date

## References

- [https://me.sap.com/notes/3751691](https://me.sap.com/notes/3751691)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP S/4HANA authorization bypass in business object modification](https://junglewise.ai/threats/cve-2026-89121-sap-s-4hana-does-not-perform-sufficient-instance-level)
- [SAP S/4HANA code injection in substitution/validation rules](https://junglewise.ai/threats/cve-2026-89107-sap-s-4hana-manage-substitution-validation-rules-does-not)
- [SAP S/4HANA authorization bypass in Manage Bank Chains app](https://junglewise.ai/threats/cve-2026-76962-sap-s-4hana-authorization-bypass-in-manage-bank-chains-app)
- [SAP S/4HANA SQL injection in Intercompany Matching and Reconciliation](https://junglewise.ai/threats/cve-2026-44766-sap-s-4hana-sql-injection-in-intercompany-matching-and)
- [SAP S/4HANA ReDoS in third-party component](https://junglewise.ai/threats/cve-2026-66766-sap-s-4hana-redos-in-third-party-component)