What’s Vulnerable › Vulnerabilities
CVE-2026-44766: SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-08 · updated 2026-09-08
- Weakness: CWE-89
Description
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
Affected products
- SAP_SE SAP S/4HANA (Intercompany Matching and Reconciliation): SAPSCORE 136, S4CORE 104, 105, 106, 107, 108 (+1)
References
Get alerted when CVE-2026-44766 or the next vulnerability affects your stack