CVE-2026-44751: SAP ABAP Privilege Escalation Vulnerability

CVE-2026-44751 Overview

CVE-2026-44751 is a missing authorization vulnerability [CWE-862] affecting SAP NetWeaver Application Server ABAP. The flaw allows an authenticated attacker to invoke a report generation command without proper authorization checks. Successful exploitation lets the attacker overwrite data belonging to other users, leading to privilege escalation. The vulnerability requires network access and low privileges, with no user interaction needed. Impact is high on integrity, low on availability, and none on confidentiality.

Critical Impact
An authenticated attacker on the network can overwrite information owned by other users and escalate privileges within the Application Server ABAP environment.

Affected Products

SAP NetWeaver Application Server ABAP (see SAP Note 3735546 for affected versions)
ABAP-based SAP business applications relying on the affected report generation component
Systems exposing the vulnerable ABAP functionality to authenticated network users

Discovery Timeline

2026-06-09 - CVE-2026-44751 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44751

Vulnerability Analysis

The vulnerability resides in the Application Server ABAP component of SAP NetWeaver. The affected report generation command fails to validate whether the calling user holds the required authorization objects before performing write operations. As a result, an authenticated user with low-privilege access can invoke functionality that modifies records owned by other users.

Because the write path bypasses authorization enforcement, the attacker can overwrite arbitrary user-owned information processed by the report generator. This produces an integrity compromise that translates into a privilege escalation when overwritten records control access decisions, configuration values, or business state.

The issue is classified under [CWE-862] Missing Authorization. The attack vector is network-based and does not require user interaction. The EPSS data published on 2026-06-11 indicates a low probability of opportunistic exploitation, but the integrity impact remains significant for any SAP landscape exposing the vulnerable function.

Root Cause

The report generation command implementation in ABAP does not perform an AUTHORITY-CHECK against the relevant authorization object prior to executing data modification. Authorization enforcement is expected before any state-changing operation, but this code path executes the write irrespective of the caller's effective permissions.

Attack Vector

An attacker first authenticates to the SAP system using any valid low-privilege account. The attacker then triggers the vulnerable report generation command over the network. Because authorization is not enforced, the command executes a write operation that overwrites records belonging to a higher-privileged user or to another tenant of the application logic, producing escalation of privileges.

No verified public proof-of-concept code is available for CVE-2026-44751. Refer to SAP Note 3735546 for vendor technical details.

Detection Methods for CVE-2026-44751

Indicators of Compromise

Execution of the affected report generation transaction or function module by users who lack the corresponding business authorization objects.
Unexpected modifications to user-owned records where the change document log shows a different user as the modifier than the data owner.
Anomalous spikes in invocations of the impacted ABAP report from accounts that historically do not run it.

Detection Strategies

Enable and review SAP Security Audit Log (transaction SM19/RSAU_CONFIG) entries for the affected transactions and function modules.
Compare authorization traces (STAUTHTRACE) against expected role assignments to identify calls that proceed without a successful authority check.
Correlate change documents (CDHDR/CDPOS) with role assignments to surface writes performed by users whose roles do not authorize the operation.

Monitoring Recommendations

Forward SAP Security Audit Log, system log, and change document data to a centralized analytics platform for behavioral baselining.
Alert on report or RFC executions originating from service accounts or end-user accounts that deviate from established usage patterns.
Track failed and successful AUTHORITY-CHECK results around the affected component to detect probing attempts.

How to Mitigate CVE-2026-44751

Immediate Actions Required

Apply the SAP-provided correction documented in SAP Note 3735546 during the next available maintenance window.
Review user assignments for the authorization objects governing the affected report and remove unnecessary access.
Audit recent executions of the vulnerable command and validate the integrity of records that may have been modified.

Patch Information

SAP released the fix as part of SAP Security Patch Day. Customers should download and implement SAP Note 3735546 and consult the SAP Security Patch Day portal for applicability to their installed support package levels.

Workarounds

Restrict network access to the SAP Application Server ABAP so only required client networks can reach authenticated endpoints.
Tighten role design to ensure that only explicitly authorized users hold execution rights for the affected report or function module.
Increase Security Audit Log coverage on the impacted objects until the patch is applied to detect exploitation attempts.

bash

# Configuration example
# Enable Security Audit Log filter for the affected component (illustrative)
# Transaction: RSAU_CONFIG
#   Filter: Active = X
#   Audit Classes: Transaction start, RFC call, Report start
#   Users: *
#   Events: AU1, AU2, AU3, AU5, AUO, AUP