SAP S/4HANA PPM-PRO CVE-2026-44769

Exploitation requires the attacker to hold high privileges within the SAP S/4HANA environment (PR:H per CVSS vector), meaning a standard SAP user role is insufficient - administrator-level or equivalent PPM-PRO access is necessary. Attack complexity is high (AC:H), indicating crafted SQL input beyond trivial payloads is required. The application must have the PPM-PRO (Project Management) module deployed and accessible over the network. Limiting factors include: the high privilege barrier prevents unauthenticated or low-privileged exploitation; AC:H means generic SQL injection tooling is unlikely to succeed without targeted query construction; and the absence of public exploit code increases the skill threshold. The description's statement of 'low impact on confidentiality' versus the vector's C:H should be verified with SAP before treating this as a high-severity data exfiltration risk.

Real-world risk is moderate despite the high confidentiality impact (C:H) in the CVSS vector. The PR:H requirement means only users with high privileges within the SAP environment can exploit this, substantially reducing the attacker population to insiders or already-compromised high-privilege accounts. AC:H further limits exploitation to those capable of crafting specific database queries. There is no CISA KEV listing and no public proof-of-concept identified, placing exploitation probability in the lower range. EPSS data was not provided. Notably, the CVE description text states 'low impact on confidentiality' while the CVSS vector specifies C:H - this is a direct contradiction that defenders should escalate to vendor clarification before making patching priority decisions. The 5.5 base score correctly reflects the constrained exploitability even if the impact metrics are internally inconsistent with the prose description.

An attacker with high-privilege access to the SAP S/4HANA PPM-PRO module - such as a project manager or administrator role - submits a specially crafted input to a project management function that is passed unsanitized into a backend HANA database query. The injected SQL clause extracts data from the HANA database schema, potentially including project financial records, resource data, or other sensitive enterprise data stored in related tables. No public exploit code exists at time of analysis, making this scenario more relevant to insider threat or post-compromise lateral movement than opportunistic external attack.