Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by sap

CVE-2026-44751Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform

High 7.1

In plain English

A high-severity missing authorization in SAP NetWeaver AS ABAP and ABAP Platform from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 89.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP NetWeaver AS ABAP and ABAP Platform SAP_BASIS 700SAP_BASIS 701SAP_BASIS 702SAP_BASIS 731SAP_BASIS 740SAP_BASIS 750SAP_BASIS 751SAP_BASIS 752

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References