What is the CVSS score of CVE-2026-44771?

CVE-2026-44771 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

SAP S/4HANA CVE-2026-44771

EUVD-2026-43595 MEDIUM

Missing Authorization (CWE-862)

2026-07-14 sap

GHSA-jf6p-qvqv-f6g9

SAP Authentication Bypass Sap S 4Hana Draft Operation

4.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint, low complexity; PR:L because a valid authenticated session is required; confidentiality-only at low tier with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 01:21 vuln.today

CVE Published

Jul 14, 2026 - 00:21 cve.org

MEDIUM 4.3

DescriptionCVE.org

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.

AnalysisAI

Privilege escalation in SAP S/4HANA's Draft Operation component allows authenticated restricted users to read entity data beyond their authorized scope due to missing authorization checks. The flaw, classified under CWE-862, is exploitable over the network without elevated privileges, resulting in low confidentiality impact with no effect on integrity or availability. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk bounded despite the network-accessible attack vector.

Technical ContextAI

SAP S/4HANA is an enterprise ERP platform by SAP SE. The Draft Operation feature allows users to save incomplete business documents or records in a transient state before final posting. The vulnerability stems from CWE-862 (Missing Authorization): the draft operation handler fails to enforce access control checks before returning entity data to the requesting authenticated user. The CPE string cpe:2.3:a:sap_se:sap_s/4hana_(draft_operation):*:*:*:*:*:*:*:* with a wildcard version field suggests all currently tracked versions of the Draft Operation component are affected. The CVSS vector AV:N/AC:L/PR:L confirms the flaw is remotely reachable by any low-privilege authenticated user without additional complexity.

RemediationAI

Apply the fix documented in SAP Security Note 3515598 (https://me.sap.com/notes/3515598), which is the authoritative vendor remedy for this authorization gap. The exact patched product version is not independently confirmed from available input data; customers should consult the SAP Note directly to identify the applicable Support Package or correction instruction for their release. As a compensating control pending patch application, administrators can restrict access to Draft Operation functionality by tightening SAP authorization objects (e.g., reviewing and trimming roles granted to restricted users that allow access to draft-enabled entities). Be aware this may impact legitimate workflows for users who rely on draft save features. Additionally, audit SAP access logs for anomalous draft operation read patterns from restricted user accounts to detect opportunistic exploitation prior to patching.