{"api_version":"1","generated_at":"2026-09-08T09:13:17+00:00","cve":"CVE-2026-44766","urls":{"html":"https://cve.report/CVE-2026-44766","api":"https://cve.report/api/cve/CVE-2026-44766.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-44766","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-44766"},"summary":{"title":"SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)","description":"SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.","state":"PUBLISHED","assigner":"sap","published_at":"2026-09-08 01:17:30","updated_at":"2026-09-08 01:17:30"},"problem_types":["CWE-89","CWE-89 CWE-89: Improper Neutralization of Special Elements used in an SQL Command"],"metrics":[{"version":"3.1","source":"cna@sap.com","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://url.sap/sapsecuritypatchday","name":"https://url.sap/sapsecuritypatchday","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://me.sap.com/notes/3756450","name":"https://me.sap.com/notes/3756450","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44766","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44766","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected SAPSCORE 136","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected S4CORE 104","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected 105","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected 106","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected 107","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected 108","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","version":"affected 109","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","vendor":"SAP_SE","versions":[{"status":"affected","version":"SAPSCORE 136"},{"status":"affected","version":"S4CORE 104"},{"status":"affected","version":"105"},{"status":"affected","version":"106"},{"status":"affected","version":"107"},{"status":"affected","version":"108"},{"status":"affected","version":"109"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.</p>"}],"value":"SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command","lang":"eng","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-08T00:10:34.051Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"url":"https://me.sap.com/notes/3756450"},{"url":"https://url.sap/sapsecuritypatchday"}],"source":{"discovery":"UNKNOWN"},"title":"SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2026-44766","datePublished":"2026-09-08T00:10:34.051Z","dateReserved":"2026-05-07T18:39:44.147Z","dateUpdated":"2026-09-08T00:10:34.051Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-08 01:17:30","lastModifiedDate":"2026-09-08 01:17:30","problem_types":["CWE-89","CWE-89 CWE-89: Improper Neutralization of Special Elements used in an SQL Command"],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"44766","Ordinal":"1","Title":"SQL Injection vulnerability in SAP S/4HANA (Intercompany Matchin","CVE":"CVE-2026-44766","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"44766","Ordinal":"1","NoteData":"SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.","Type":"Description","Title":"SQL Injection vulnerability in SAP S/4HANA (Intercompany Matchin"}]}}}