CVE-2026-44769
Full vulnerability record from the local CVENow database.
Description
SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-07-14 01:16:18.370000
Last modified
2026-10-24 22:10:00.210000
View original CVE JSON
{
"id": "CVE-2026-44769",
"sourceIdentifier": "[email protected]",
"published": "2026-07-14T01:16:18.370",
"lastModified": "2026-10-24T22:10:00.210",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application."
},
{
"lang": "es",
"value": "La aplicación SAP S/4HANA Project Management (PPM-PRO) permite a un atacante con altos privilegios ejecutar consultas de base de datos manipuladas, exponiendo la base de datos de backend. Esto resulta en un impacto bajo en la confidencialidad, sin impacto en la integridad y disponibilidad de la aplicación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SAP_SE",
"product": "SAP S/4HANA Project Management (PPM-PRO)",
"defaultStatus": "unaffected",
"versions": [
{
"version": "SAP_APPL 600",
"status": "affected"
},
{
"version": "602",
"status": "affected"
},
{
"version": "603",
"status": "affected"
},
{
"version": "604",
"status": "affected"
},
{
"version": "605",
"status": "affected"
},
{
"version": "606",
"status": "affected"
},
{
"version": "617",
"status": "affected"
},
{
"version": "618",
"status": "affected"
},
{
"version": "S4CORE 102",
"status": "affected"
},
{
"version": "103",
"status": "affected"
},
{
"version": "104",
"status": "affected"
},
{
"version": "105",
"status": "affected"
},
{
"version": "106",
"status": "affected"
},
{
"version": "107",
"status": "affected"
},
{
"version": "108",
"status": "affected"
},
{
"version": "CPRXRPM 400",
"status": "affected"
},
{
"version": "450_700",
"status": "affected"
},
{
"version": "500_702",
"status": "affected"
},
{
"version": "610_740",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 0.7,
"impactScore": 4.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-14T12:49:48.848878Z",
"id": "CVE-2026-44769",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3537373",
"source": "[email protected]"
},
{
"url": "https://url.sap/sapsecuritypatchday",
"source": "[email protected]"
}
]
}