Authenticated SQL Injection in SAP S/4HANA Intercompany Matching and Reconciliation
AI analysis
CVE-2026-44766 is a SQL injection flaw (CWE-89) in the Intercompany Matching and Reconciliation (IMR) component of SAP S/4HANA. A low-privileged authenticated user can submit crafted input to certain IMR functions, which is passed to the underlying database without proper validation, allowing malicious queries to execute. An attacker gains unauthorized read access to sensitive information in the database — a high confidentiality impact — with no effect on integrity or availability, and no user interaction is required beyond the attacker's own valid low-privilege session. Only organizations running SAP S/4HANA with the IMR component in use are affected; exposure is internal-facing, since exploitation requires an authenticated account rather than anonymous internet access. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS of 0.2% (13th percentile) indicates no known exploitation; fixes were shipped as part of SAP's September 2026 Security Patch Day.
What to do: Apply the SAP September 2026 Security Patch Day corrections for S/4HANA IMR, checking the SAP Security Note for this CVE to match the correct patch level to your installed release. Until patched, restrict low-privileged access to the affected IMR functions and review database logs for unexpected or anomalous queries issued by IMR service users.
Affected
| SAP S/4HANA — Intercompany Matching and Reconciliation (IMR) component | — |
Estimated exposure
moderateon the order of 1,000–10,000 enterprise deployments of the affected component (estimate) — SAP S/4HANA has a large installed base (tens of thousands of enterprise customers), but the IMR component is typically used only by organizations performing intercompany reconciliation across multiple legal entities, so a subset —…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.