CVE-2026-44766: SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated SAP S/4HANA account with low-level privileges. The issue is remotely exploitable and does not require user interaction.
What is the likely impact if exploitation succeeds?
Successful exploitation may allow access to sensitive information through SQL injection. The provided assessment indicates high confidentiality impact, with no integrity or availability impact.
Which part of SAP S/4HANA is affected?
The affected component is Intercompany Matching and Reconciliation. The issue involves certain functions that may pass insufficiently validated input to the database.
How can I determine whether my system is affected?
Review whether your SAP S/4HANA deployment uses the Intercompany Matching and Reconciliation component and consult SAP Note 3756450 for affected-system and remediation details.