What is the CVSS score of CVE-2026-44751?

CVE-2026-44751 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of SAP NetWeaver ABAP are affected by CVE-2026-44751?

SAP NetWeaver Application Server ABAP contains a privilege escalation vulnerability (CVE-2026-44751) that allows authenticated users to execute report generation commands that overwrite data…

How to fix or mitigate CVE-2026-44751?

Within 24 hours: Inventory all SAP NetWeaver Application Server ABAP systems and document current user privilege assignments. Within 7 days: Implement role-based access controls to restrict report generation command execution to designated administrators only, enable detailed audit logging for data modification activities, and apply application-layer authorization validations. Within 30 days: Monitor SAP security advisories for patch release; evaluate temporary disablement of non-critical report functionality or network segmentation as interim strategies.

SAP NetWeaver ABAP CVE-2026-44751

EUVD-2026-35285 HIGH

Missing Authorization (CWE-862)

2026-06-09 cna@sap.com

GHSA-5h92-3583-x7wf

Authentication Bypass

7.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 01:32 vuln.today

DescriptionCVE.org

Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

AnalysisAI

Privilege escalation in SAP NetWeaver Application Server ABAP allows authenticated low-privilege users to invoke a report generation command that overwrites data belonging to other users, breaking tenant-level data integrity. The flaw stems from missing authorization checks (CWE-862) and carries a CVSS 7.1 rating with high integrity impact; no public exploit identified at time of analysis.

Technical ContextAI

SAP NetWeaver Application Server ABAP is the runtime that hosts SAP business applications written in the ABAP language and exposes report/transaction execution to authenticated users. The root cause is CWE-862 (Missing Authorization): a report-generation entry point fails to verify that the calling user is permitted to act on the targeted data object before writing. In SAP environments, authorization is normally enforced through AUTHORITY-CHECK statements against authorization objects; when those checks are omitted on a write path, any session that can reach the report can mutate records owned by other principals, regardless of the role model configured by the Basis team.

RemediationAI

Patch available per vendor advisory: apply SAP Security Note 3735546 (https://me.sap.com/notes/3735546), released as part of the SAP Security Patch Day bundle indexed at https://url.sap/sapsecuritypatchday, which is the authoritative source for the exact corrected Support Package and kernel levels. Until the note can be applied, restrict execution of the affected report and its underlying transaction/RFC via SU24/PFCG by removing S_TCODE and S_PROGRAM authorizations for the report from non-administrative roles, and constrain network reach to the application server's HTTP/RFC endpoints through SAP Web Dispatcher and segmentation - be aware this can break legitimate business users who currently rely on the report, so coordinate with functional owners before tightening roles.