CVE-2026-44754

6.6 MEDIUM

The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identificat...

Published: 2026-06-09 · Last updated: 2026-06-09

Severity and scoring

CVSS: 6.6 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
CWE: CWE-862

Description

The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification of permitted SAP-internal applications and are being used by customer or third-party applications in ways that are not aligned with its intended usage. Which could lead to unintended disclosure of data, but does not affect integrity, and poses minimal availability concerns for the application.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-44754
[Other]https://me.sap.com/notes/3748819
[Other]https://url.sap/sapsecuritypatchday

Related CVEs

Same CWE

CVE-2026-46645 — SQLAdmin is a flexible Admin interface for SQLAlchemy models (4.3 MEDIUM)
CVE-2026-53634 — Sharp is a content management framework built for Laravel as a package (4.3 MEDIUM)
CVE-2026-0272 — A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Comm...
CVE-2026-49822 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)
CVE-2026-49821 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (7.7 HIGH)