High severity · published Jun 9, 2026
CVE-2026-44751
Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS ABAP and ABAP Platform · SAP_SE
SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; +9 more · source: vendor
Affected product
SN
SAP NetWeaver AS ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44751
me.sap.com
https://me.sap.com/notes/3735546
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver AS ABAP and ABAP Platform
9.9
CVE-2026-44748
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
9.8
CVE-2026-27671
Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
8.8
CVE-2026-23687
XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform