{"id":"CVE-2026-44766","title":"SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation","summary":"SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the us…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-89"],"vendor":"SAP_SE","product":"SAP S/4HANA (Intercompany Matching and Reconciliation)","affected":["sap_s_4hana_intercompany_matching_and_reconciliation SAPSCORE 136","sap_s_4hana_intercompany_matching_and_reconciliation S4CORE 104","sap_s_4hana_intercompany_matching_and_reconciliation 105","sap_s_4hana_intercompany_matching_and_reconciliation 106","sap_s_4hana_intercompany_matching_and_reconciliation 107","sap_s_4hana_intercompany_matching_and_reconciliation 108","sap_s_4hana_intercompany_matching_and_reconciliation 109"],"published":"2026-09-08","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:12:59.557","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44766","references":[{"url":"https://me.sap.com/notes/3756450","label":"cna@sap.com"},{"url":"https://url.sap/sapsecuritypatchday","label":"cna@sap.com"}],"tags":["nvd","cve.org"],"epss":0.00227,"epssPercentile":0.1373,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-08T10:05:31.349235Z"},"ingestedAt":"2026-09-08T15:33:26.981Z","slug":"CVE-2026-44766","body":"## Overview\n\nSAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}