CVE-2026-44743: SAP Business Objects Info Disclosure Flaw

CVE-2026-44743 Overview

CVE-2026-44743 is an information disclosure vulnerability affecting SAP Business Objects. Under specific conditions, an unauthenticated attacker accessing a particular endpoint can retrieve sensitive information from the application. The flaw is categorized under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

The vulnerability impacts only the confidentiality of data. Integrity and availability of the SAP Business Objects application remain unaffected. SAP addressed the issue through SAP Note #3706000, published on SAP Security Patch Day.

Critical Impact
Unauthenticated network-based access to a specific SAP Business Objects endpoint can disclose sensitive application data without requiring user interaction.

Affected Products

SAP Business Objects (specific versions referenced in SAP Note #3706000)
Deployments exposing the affected endpoint to network-reachable clients
Environments without the latest SAP Security Patch Day update applied

Discovery Timeline

2026-06-09 - CVE-2026-44743 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44743

Vulnerability Analysis

The vulnerability resides in an SAP Business Objects endpoint that returns sensitive information when accessed under specific conditions. An attacker does not need valid credentials or user interaction to trigger the disclosure. The flaw allows remote access over the network, though exploitation requires meeting certain preconditions that increase attack complexity.

SAP categorizes the issue under [CWE-497], which covers exposure of system information to an unauthorized actor. The disclosed data is limited in scope and does not enable modification of application state or disruption of service. The EPSS probability indicates a low likelihood of exploitation in the near term.

Root Cause

The root cause is improper restriction of information returned by a specific application endpoint. The endpoint fails to enforce authentication or proper access control checks before returning data that should be protected. As a result, sensitive details intended for authorized users become accessible to anonymous network clients meeting the trigger conditions.

Attack Vector

An attacker reaches the vulnerable endpoint over the network without authentication. The required conditions raise the attack complexity, meaning successful exploitation depends on environmental or timing factors outside the attacker's full control. When the conditions align, the application returns sensitive data in the response to the attacker's request.

No public proof-of-concept code, exploit module, or in-the-wild exploitation has been reported. See the SAP Note #3706000 and SAP Security Patch Day advisories for vendor-specific technical details.

Detection Methods for CVE-2026-44743

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to SAP Business Objects endpoints originating from unexpected external sources
Anomalous response sizes from Business Objects endpoints that normally require authentication
Repeated probing of Business Objects URLs without preceding authentication flows in web server logs

Detection Strategies

Review SAP Business Objects access logs for requests to the affected endpoint described in SAP Note #3706000
Correlate web application firewall logs with successful 200 responses to unauthenticated sessions on Business Objects paths
Baseline normal request patterns to Business Objects and alert on anonymous access attempts to sensitive endpoints

Monitoring Recommendations

Forward SAP Business Objects web server and application logs to a centralized logging platform for retention and search
Configure alerts for high-volume scanning patterns targeting SAP application endpoints
Monitor outbound data volumes from Business Objects servers for unexpected spikes that may indicate enumeration

How to Mitigate CVE-2026-44743

Immediate Actions Required

Apply the patch referenced in SAP Note #3706000 to all affected SAP Business Objects instances
Restrict network access to Business Objects management and administrative endpoints to trusted internal networks only
Review access logs since the affected version was deployed for evidence of probing against the disclosed endpoint

Patch Information

SAP released a fix as part of SAP Security Patch Day. Administrators should consult SAP Note #3706000 for the exact patch identifiers, affected support package levels, and installation instructions. Refer to the SAP Security Patch Day page for the broader patch bundle and prerequisites.

Workarounds

Block external access to the vulnerable endpoint at a reverse proxy or web application firewall until patching is complete
Limit Business Objects exposure to authenticated VPN users where business processes allow
Implement network segmentation to isolate SAP application servers from general user networks

bash

# Example WAF rule to block unauthenticated access to a sensitive Business Objects path
# Replace <vulnerable-endpoint> with the path identified in SAP Note #3706000
SecRule REQUEST_URI "@beginsWith /<vulnerable-endpoint>" \
    "id:1004743,phase:1,deny,status:403,\
     msg:'Block unauthenticated access to SAP BO endpoint (CVE-2026-44743)',\
     chain"
    SecRule &REQUEST_HEADERS:Authorization "@eq 0"