SAP S/4HANA CVE-2026-44771

Exploitation requires a valid authenticated session in SAP S/4HANA with at least low-privilege access (PR:L per CVSS vector). The attacker must be a 'restricted user' - an account that has some system access but is not authorized to view specific entity data. The Draft Operation feature must be in use within the target S/4HANA deployment; organizations that do not use draft-enabled Fiori or OData services may have reduced exposure. Exploitation is limited to information disclosure only: no write, delete, or system-wide access is achievable through this flaw. No special network position (e.g., internal network) is required beyond normal SAP system reachability, as AV:N indicates the endpoint is network-accessible. Factors limiting real-world impact include the requirement for prior authentication, the low confidentiality impact tier, and no current public exploit.

The CVSS base score of 4.3 (Medium) accurately reflects the constrained impact: the attack vector is network-accessible (AV:N) with low complexity (AC:L) and requires only low-privilege authentication (PR:L), but scope is unchanged (S:U) and impact is limited strictly to confidentiality at the low tier (C:L/I:N/A:N). No EPSS data was provided in the input, so exploitation probability cannot be quantified. KEV status is negative and no POC has been identified, meaning this is rated 'no public exploit identified at time of analysis.' The realistic priority for most organizations is moderate: the flaw is reachable by any authenticated SAP user, making insider threat or compromised-account scenarios the primary concern. However, the low confidentiality impact and absence of integrity or availability consequences limit the blast radius significantly. SSVC signals suggest exploitation is possible but not currently observed, and technical impact is partial - this is not a top-tier emergency patch but should be addressed in the next scheduled SAP maintenance cycle.

An authenticated SAP S/4HANA user with a restricted role - such as a read-only reporting user or a user with access limited to specific business units - sends a network request to the Draft Operation endpoint for an entity outside their authorized scope. Because authorization checks are absent, the server returns the draft entity data without validating the user's permissions, exposing potentially sensitive business records such as draft purchase orders, financial postings, or HR records. No public exploit code is known, so exploitation currently requires manual discovery of the endpoint and parameters by a motivated insider or compromised account holder.