CVE-2026-44754: SAP ODP-RFC Information Disclosure Flaw

CVE-2026-44754 Overview

CVE-2026-44754 is a missing authorization vulnerability [CWE-862] affecting the Remote Function Call (RFC) modules of the SAP Operational Data Provisioning Data Replication API (ODP-RFC). The RFC modules do not verify the identity of callers that should be restricted to permitted SAP-internal applications. Customer or third-party applications can invoke these modules in ways outside their intended usage, leading to unintended disclosure of data. The flaw does not affect data integrity and has minimal impact on availability.

Critical Impact
Unauthorized callers with high privileges can leverage ODP-RFC modules to disclose sensitive replicated data across security scopes within an SAP environment.

Affected Products

SAP Operational Data Provisioning Data Replication API (ODP-RFC)
SAP NetWeaver components exposing ODP-RFC modules
Refer to SAP Note #3748819 for the complete list of affected component versions

Discovery Timeline

2026-06-09 - CVE-2026-44754 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44754

Vulnerability Analysis

The Operational Data Provisioning (ODP) framework in SAP enables data replication between source systems and consumers such as SAP BW, SAP Data Services, and SAP HANA. The ODP-RFC modules expose this replication capability through Remote Function Call interfaces. These modules were designed for invocation by permitted SAP-internal applications only.

The vulnerability stems from missing caller identification logic. The RFC modules fail to validate whether the calling application is an authorized SAP-internal component. As a result, customer-developed or third-party applications can invoke the modules and access replicated data outside the intended security boundary.

Exploitation requires network access to the RFC interface and an authenticated principal with high privileges. The scope is changed because the disclosed data may belong to systems or consumers other than the calling context. Confidentiality impact is high while integrity remains unaffected and availability impact is limited.

Root Cause

The ODP-RFC modules assume callers are trusted SAP-internal applications and omit authorization checks that bind invocation to those callers. This assumption breaks when customer code or third-party code reuses the modules, exposing replication data without enforcement of the original usage contract [CWE-862].

Attack Vector

An attacker with valid RFC credentials and high privilege levels can call the affected ODP-RFC function modules over the network. The modules return replicated dataset content without verifying that the caller is a sanctioned SAP-internal application. Successful exploitation discloses ODP-managed data that the caller would not otherwise be authorized to obtain through approved interfaces.

No public proof-of-concept or exploit code is available. Technical specifics are restricted to authenticated SAP customers via SAP Note #3748819.

Detection Methods for CVE-2026-44754

Indicators of Compromise

RFC calls to ODP function modules originating from non-SAP-internal program IDs or unexpected RFC destinations
Unusual volumes of ODP data extraction requests from a single user or service account
Authentication events from high-privilege technical users invoking ODP-RFC outside scheduled replication windows

Detection Strategies

Audit SAP Security Audit Log (transaction SM19/RSAU_CONFIG) for RFC calls targeting ODP modules from non-approved callers
Review ST03N workload statistics for anomalous RFC invocations of ODP function groups
Correlate RFC gateway logs with the list of approved SAP-internal applications documented in SAP Note #3748819

Monitoring Recommendations

Enable RFC logging on the gateway (gw/logging) and forward events to a centralized SIEM for analysis
Baseline expected ODP-RFC callers and alert on deviations
Monitor changes to RFC trust relationships and authorization role assignments that grant ODP execution rights

How to Mitigate CVE-2026-44754

Immediate Actions Required

Apply the patch referenced in SAP Note #3748819 following the monthly SAP Security Patch Day guidance
Review and restrict authorizations for RFC users that can execute ODP function modules
Inventory customer and third-party applications calling ODP-RFC and validate they are in scope of the intended usage

Patch Information

SAP has issued a security correction described in SAP Note #3748819. Customers must authenticate to the SAP support portal to obtain the patch and implementation instructions. Apply the note to all systems running affected ODP-RFC components and validate replication workflows after deployment.

Workarounds

Restrict RFC access to ODP function groups using authorization object S_RFC until the patch is applied
Configure the RFC gateway access control lists (reginfo and secinfo) to permit only known SAP-internal program IDs
Remove or disable unused RFC destinations that expose ODP modules to customer or third-party code

bash

# Example RFC gateway secinfo entry restricting ODP callers
# /usr/sap/<SID>/<INSTANCE>/data/secinfo
P TP=<approved_program_id> HOST=<approved_host> USER=* USER-HOST=<approved_host>
D TP=* HOST=* USER=* USER-HOST=*