CVE-2026-44766
published 2026-09-08CVE-2026-44766: SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.39%
31.4th percentile
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_s_4hana | — | — |
| sap_se | sap_s_4hana | — | — |
| sap_se | sap_s_4hana | — | — |
| sap_se | sap_s_4hana | — | — |
| sap_se | sap_s_4hana | — | — |
| sap_se | sap_s_4hana | — | — |
| sap_se | sap_s_4hana | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP S4HANA 4CORE 104 up to 109 Intercompany Matching/Reconciliation injection
vuldb·2026-09-08·CVSS 6.5
CVE-2026-44766 [MEDIUM] SAP S4HANA 4CORE 104 up to 109 Intercompany Matching/Reconciliation injection
A vulnerability, which was classified as problematic, has been found in SAP S4HANA 4CORE 104 up to 109. Impacted is an unknown function of the component Intercompany Matching/Reconciliation. The manipulation leads to injection.
This vulnerability is documented as CVE-2026-44766. The attack can be initiated remotely. There is not any exploit available.
GHSA
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without prope
ghsa_unreviewed·2026-09-08
CVE-2026-44766 [MEDIUM] CWE-89 SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without prope
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-08
Published