CVE-2026-44751: Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Synopsis

Missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker to invoke a report generation command without the required permissions. The vulnerability is reachable over the network and requires only a low-privilege account, with no victim interaction needed. Successful exploitation lets the attacker overwrite data belonging to other users, constituting a privilege escalation with high impact on integrity and low impact on availability. No fix version has been published by SAP; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the AS ABAP service over the network; no local or physical access is required.

• AuthenticationRequired

  A valid low-privilege account on the system is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  The attacker acts entirely on their own and does not need any other user to click a link, open a file, or take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or unusual environmental factors are required.

Blast Radius

• Attacker overwrites report data or configuration objects owned by other users, corrupting their work or security-relevant settings.
• By substituting data under another user's identity, the attacker can escalate effective privileges within the ABAP application layer.
• Execution of the unauthorized report generation command can cause minor service degradation or partial unavailability of affected report resources.