CVE-2026-44744: SAP S/4HANA SQL Injection Vulnerability (CVSS 6.5)

Technical summary

This SQL injection vulnerability (CWE-89) exists in a remote-enabled function module within SAP S/4HANA On-Premise deployments. The flaw permits authenticated attackers to inject arbitrary SQL commands through inadequately sanitized input parameters. The remote-enabled nature of the affected module means the vulnerability is reachable over the network by any user with valid system credentials. The injection leads to unauthorized database query execution, enabling extraction of confidential information. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network-accessible attack surface with low complexity, authenticated access requirement, and high confidentiality impact.

Business impact

Data confidentiality is the primary concern. Authenticated insiders or accounts compromised through credential theft could extract sensitive business data—customer information, financial records, intellectual property, or strategic data stored in the S/4HANA database. While system availability and data integrity remain unaffected, unauthorized data exposure can trigger regulatory compliance violations (GDPR, HIPAA, industry-specific frameworks), damage customer trust, and create legal liability. Organizations with strict data segregation policies may face internal control failures if lower-privileged users exploit the flaw to access information outside their authorized scope.

Affected systems

SAP S/4HANA running On-Premise deployments are affected. Cloud deployments (SAP S/4HANA Cloud) are not impacted by this vulnerability. The vulnerability requires the attacker to be an authenticated user of the system; it cannot be exploited remotely without valid credentials. Organizations running S/4HANA On-Premise should verify their deployment scope and user access policies to identify exposed instances.

Exploitability

Exploitation requires valid S/4HANA credentials—the attacker cannot access the vulnerable function module anonymously. However, once authenticated, the attack is straightforward: the low attack complexity (AC:L) indicates minimal technical skill is needed to craft SQL injection payloads. The vulnerability is not known to be actively exploited in the wild, and it does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog. Insider threats and credential compromise represent the most practical attack vectors.

Remediation

SAP has released patches to address this SQL injection flaw. Organizations should obtain and apply the appropriate patch from SAP's security advisory as soon as possible. Patch availability and version numbers vary by S/4HANA release line; consult your SAP support portal or the official security advisory for your specific deployment version. In parallel, implement compensating controls: restrict remote function module access via authorization roles, enforce principle-of-least-privilege database access, and monitor for unusual SQL query patterns in audit logs.

Patch guidance

Contact SAP support or consult the official SAP security advisory for your S/4HANA On-Premise version to obtain the correct patch. Test patches in a non-production environment before rolling out to live systems. Apply patches promptly given the direct impact on data confidentiality. If patching is delayed, implement temporary mitigations through role-based access control (RBAC) adjustments and network segmentation to limit exposure.

Detection guidance

Monitor S/4HANA database logs and function module audit trails for suspicious SQL patterns, especially queries containing SQL metacharacters (single quotes, UNION clauses, comment sequences) originating from the affected remote-enabled module. Correlate user login activity with anomalous database access patterns; detect low-privileged users querying sensitive tables outside their normal scope. Search for unusual batch job submissions or scheduled tasks that may execute malicious SQL. Review user entitlements to the affected function module and disable access for users who do not require it.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), confidentiality impact on a financial and operational system like S/4HANA warrants prompt attention. S/4HANA typically stores highly sensitive business data; unauthorized disclosure carries significant regulatory and reputational risk. The fact that exploitation requires authentication reduces immediate urgency but does not eliminate the threat, especially in environments with weak credential management or high insider risk. Organizations should patch within 30–60 days unless compensating controls are demonstrably effective.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (C:H) offset by the requirement for authenticated access (PR:L) and absence of integrity/availability effects (I:N, A:N). The network-accessible attack vector (AV:N) and low attack complexity (AC:L) indicate the flaw is easily exploitable once credentials are obtained. The MEDIUM severity classification appropriately balances the real harm (data exposure) against the authentication barrier, making this a relevant but not critical-tier vulnerability.

Frequently asked questions