CVE-2026-44754: Missing caller identification check-in for ODP Data Replication APIs
The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification of permitted SAP-internal applications and are being used by customer or third-party applications in ways that are not aligned with its intended usage. Which could lead to unintended disclosure of data, but does not affect integrity, and poses minimal availability concerns for the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement and enforce caller identification checks in the ODP-RFC RFC modules so only permitted SAP-internal applications may invoke the APIs.
ODP Data Replication (ODP-RFC) RFC modules caller_identification_check = enabled - Compensating control
Restrict access to ODP-RFC endpoints until caller identification is enforced — e.g., apply firewall rules, API gateway policies, or ACLs to allow only trusted SAP-internal systems and networks.
- Operational
Inventory and audit current callers of the ODP-RFC modules, identify customer or third‑party integrations using the APIs in unintended ways, disable or remediate unauthorized integrations, and review logs for possible data disclosure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44754?
CVE-2026-44754 has a medium severity rating of 6.6.
What does CVE-2026-44754 affect?
CVE-2026-44754 affects the SAP Operational Data Provisioning Data Replication API (ODP-RFC).
How do I fix CVE-2026-44754?
To fix CVE-2026-44754, ensure that proper caller identification checks for permitted SAP-internal applications are implemented.
What can happen if CVE-2026-44754 is exploited?
Exploitation of CVE-2026-44754 can lead to unauthorized access and usage of the ODP Data Replication APIs by non-permitted applications.
When was CVE-2026-44754 published?
CVE-2026-44754 was published on June 9, 2026.