SAP Gateway CVE-2026-44749

Exploitation requires an authenticated session with at least low-privilege access to the SAP Gateway (CVSS PR:L confirmed). The attacker must be able to send HTTP requests over the network to the Gateway endpoint (AV:N, AC:L). No user interaction is required (UI:N). The vulnerability manifests when the Gateway processes input that triggers an error condition, causing internal artifacts to surface in the response. Exploitation is limited by the authentication requirement - unauthenticated external attackers cannot exploit this directly. Additionally, SSVC rates this as 'automatable: no', meaning scripted mass exploitation across internet-facing instances is not considered feasible. The vulnerability does not affect systems where SAP Gateway endpoints are fully restricted to backend-only access with no external or low-privilege user-facing exposure.

Real-world risk is low-to-moderate despite a network attack vector. The CVSS 4.3 score reflects the constrained impact - confidentiality only, low severity, no privilege escalation or availability impact. The PR:L requirement (authenticated, low-privilege) meaningfully narrows the attack surface: an attacker must already hold valid SAP Gateway credentials, which is a non-trivial prerequisite in enterprise environments. EPSS at 0.01% (1st percentile) and SSVC 'exploitation: none / automatable: no / technical impact: partial' all converge to indicate this is not a target of opportunistic or automated attack campaigns. The SSVC 'automatable: no' finding further reduces mass-exploitation risk. The primary real-world concern is reconnaissance value: information leaked (regex patterns, URI parsing internals) could assist a sophisticated attacker already inside the network in constructing more targeted follow-on attacks. This is not a standalone critical issue but represents an information-disclosure risk that widens an attacker's knowledge of the attack surface in a broader campaign.

An authenticated attacker with low-privilege access to the SAP Gateway OData or RFC endpoint crafts a malformed HTTP request designed to trigger an error response from the Gateway. The injected content causes the error message to reflect internal regex patterns or URI parsing logic back to the attacker, revealing implementation details about the Gateway's input processing pipeline. No public exploit code has been identified at time of analysis, but the information gained could be used to refine subsequent attack attempts against input validation or access control mechanisms in the same or connected SAP systems.