CVE-2026-44771

MEDIUM

Missing Authorization check in SAP S/4HANA (Draft operation)

Title source: cna

Description

SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.

References (2)

Core 2

Core References

https://me.sap.com/notes/3515598

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 4.3

EPSS 0.0017

EPSS Percentile 6.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

SAP_SE/SAP S/4HANA (Draft operation) S4CORE 108

Published Jul 14, 2026

Tracked Since Jul 14, 2026