CVE-2026-44770

MEDIUM

Missing Authorization check in SAP S/4 HANA (Create Single Payment)

Title source: cna

Description

SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure of information. This has low impact on confidentiality, with no impact on integrity and availability of the application.

References (2)

Core 2

Core References

https://me.sap.com/notes/3713902

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 4.3

EPSS 0.0017

EPSS Percentile 6.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (8)

SAP_SE/SAP S/4 HANA (Create Single Payment) 103

SAP_SE/SAP S/4 HANA (Create Single Payment) 104

SAP_SE/SAP S/4 HANA (Create Single Payment) 105

SAP_SE/SAP S/4 HANA (Create Single Payment) 106

SAP_SE/SAP S/4 HANA (Create Single Payment) 107

SAP_SE/SAP S/4 HANA (Create Single Payment) 108

SAP_SE/SAP S/4 HANA (Create Single Payment) 109

SAP_SE/SAP S/4 HANA (Create Single Payment) S4CORE 102

Published Jul 14, 2026

Tracked Since Jul 14, 2026