SAP MDG CVE-2026-44750

Exploitation requires an active, authenticated SAP MDG user account with at least low-level privileges - unauthenticated access is not possible per the CVSS PR:L designation. The vulnerability is specific to the Review Match Groups Application within MDG; users without access to this application component are not exposed. No special network positioning is required beyond the ability to reach the SAP MDG application server (AV:N, AC:L). Exploitation is limited to integrity impact only - attackers cannot read confidential data (C:N) or disrupt availability (A:N). The scope is contained to the MDG application boundary (S:U), preventing lateral privilege escalation into other SAP systems or the underlying OS.

The CVSS base score of 4.3 (Medium) accurately reflects a constrained impact profile: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction needed (UI:N), with only low integrity impact and no confidentiality or availability impact. The PR:L requirement is the primary limiting factor - an attacker must already possess a valid SAP MDG user account, which significantly reduces the attack surface in most enterprise environments. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public POC has been identified, suggesting opportunistic mass exploitation is not occurring. For organizations where MDG governs authoritative master data (vendor records, customer data, financial hierarchies), even low-integrity impact could have downstream business process consequences disproportionate to the CVSS score. Real-world priority should be calibrated to the sensitivity of data managed within the Review Match Groups workflow, not the raw score alone.

An authenticated SAP MDG user with a standard low-privilege account - such as a data steward or read-only reviewer - accesses the Review Match Groups Application and directly invokes backend service calls or submits crafted requests to perform actions reserved for higher-privileged roles, such as approving match group consolidations or modifying governance records. Because the authorization check is absent at the service layer, the system processes the request and persists the unauthorized data modification. No public POC exists at time of analysis, but the exploit pattern is straightforward for any user familiar with SAP MDG's application architecture.