Brief Summary: CVE-2026-44751 — SAP ABAP Missing Authorization Check Enables Privilege Escalation via Report Generation - ZeroPath Blog

Introduction

A missing authorization check in the report generation functionality of SAP Application Server ABAP lets any authenticated user overwrite executable reports owned by other users and escalate privileges. The flaw is rated CVSS 7.1. For organizations that run their financial and operational processes on SAP, it damages the integrity of business data without setting off confidentiality alarms, which makes it particularly hard to detect through conventional monitoring.

The flaw is tracked as CVE-2026-44751 and was disclosed on June 9, 2026. It continues a pattern of CWE-862 (Missing Authorization) defects that have appeared in every SAP Security Patch Day cycle throughout 2026. SAP products run in more than 157 countries and underpin the operations of most Fortune 500 companies, so the potential blast radius is substantial.

Technical Information

Root Cause: Missing AUTHORITY-CHECK in Report Generation

CVE-2026-44751 is classified under CWE-862 (Missing Authorization), a weakness in which the application does not check authorization when an actor tries to access a resource or perform an action. In the SAP ABAP runtime, the AUTHORITY-CHECK statement is the primary mechanism for enforcing role-based access control. Every sensitive operation in ABAP code is expected to include an AUTHORITY-CHECK call that validates the current user's authorization objects before it proceeds. When the statement is missing, that code path bypasses the entire role-based security model.

The vulnerability sits in the report generation functionality of the SAP_BASIS layer of SAP Application Server ABAP. According to the CVE record, the application server ABAP "does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges."

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, which breaks down as follows:

Vector Component	Value	Meaning
Attack Vector (AV)	Network	Exploitable remotely
Attack Complexity (AC)	Low	No special conditions required
Privileges Required (PR)	Low	Any authenticated user
User Interaction (UI)	None	No victim action needed
Scope (S)	Unchanged	Impact limited to vulnerable component
Confidentiality (C)	None	No data disclosure
Integrity (I)	High	Full modification of data
Availability (A)	Low	Minor disruption possible

Attack Flow

Exploiting CVE-2026-44751 takes four steps:

The attacker logs in to the SAP system with any valid user account. No administrative or elevated privileges are needed. A standard dialog user with minimal role assignments is enough.
The attacker triggers the report generation function in the ABAP application server. This could happen through a transaction, an RFC call, or any other interface that reaches the vulnerable code path. Because the code lacks an AUTHORITY-CHECK statement, the system does not verify whether the user is authorized to generate that specific report or to write to the target output destination.
The report generation command writes its output to a location or data object that belongs to another user and overwrites that user's information. This could include executable report variants, saved report outputs, or other user-specific data objects.
Overwriting another user's report data gives the attacker escalated privileges. Depending on what was overwritten, the attacker could manipulate business logic, alter financial records, or inject malicious content into reports that other users later execute.

The Integrity-First Impact Profile

The vulnerability has high integrity impact and no confidentiality impact. An attacker can corrupt or replace business data without the attack showing up in security monitoring tools that focus on data exfiltration or unauthorized reads. Traditional SIEM rules that look for unusual data access patterns may not trigger, because the attacker is writing data rather than reading it. Organizations should account for this when they design detection strategies. Change document logging and integrity monitoring become the primary detection mechanisms.

ABAP-Specific Context

Within SAP systems, missing authorization checks commonly occur in BAPIs (Business Application Programming Interfaces), RFC-enabled function modules, OData services, and ALV reports. SecurityBridge's analysis of this vulnerability class explains that "a missing SAP authority vulnerability check is a security flaw in which ABAP code fails to validate whether the current user possesses the required authorizations before executing a sensitive function or accessing protected data." The ABAP runtime does not enforce the AUTHORITY-CHECK statement automatically. Developers must add it to every sensitive code path themselves, and this manual enforcement model is the systemic root cause of the CWE-862 flaws that keep appearing in SAP products.

SAP addressed a directly comparable vulnerability, CVE-2026-0509, in the February 2026 SAP Patch Day. That flaw allowed "an authenticated, low-privileged user to perform background Remote Function Calls" without proper authorization checks in SAP NetWeaver Application Server ABAP and ABAP Platform. Each of these flaws comes from a missing AUTHORITY-CHECK statement in a different ABAP code path, and each enables a different unauthorized action.

Patch Information

SAP has released an official fix in SAP Security Note 3735546, published as part of the June 9, 2026 SAP Security Patch Day cycle. The CVE record on cve.org confirms SAP SE as the CNA and provides the authoritative vulnerability details.

The patch adds the missing authorization checks to the affected report generation code path. This is SAP's well-established way of fixing CWE-862 defects in ABAP. SAP used the same approach two months earlier for the analogous CVE-2026-34256 (SAP Note 3731908, April 2026 Patch Day). That flaw was also rated CVSS 7.1 and involved a missing authorization check in SAP ERP and SAP S/4HANA that allowed ABAP reports to be overwritten. In the April case, SecurityBridge confirmed that the fix patched specific ABAP programs (RGJVCORG and RGJVCORX) so they enforce proper authorization validation before report generation operations. SAP Note 3735546 applies the equivalent enforcement at the SAP_BASIS level for the report generation command exploited in CVE-2026-44751.

Affected SAP_BASIS Versions

The vulnerability affects a wide range of SAP_BASIS versions: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, and 816.

How to Apply the Patch

The full technical details of SAP Note 3735546, including specific correction instructions, affected kernel patch levels, and support package versions, are available only through the authenticated SAP for Me portal at https://me.sap.com/notes/3735546. Customers should apply the note with transaction SNOTE (SAP Note Assistant) or import the relevant support package stack that includes the correction. As is standard for high-severity SAP Security Notes, SAP delivers fixes for support packages shipped within the last 24 months, for all versions under mainstream and extended maintenance.

Compensating Controls

Until the patch is applied, these compensating controls can reduce risk:

Limit access to report generation transactions to the users who need them, and review the authorization objects that govern report output destinations.
Enforce the principle of least privilege. Review and tighten role assignments across ABAP user accounts so that low-privileged users cannot reach report generation functions they do not need.
Activate and audit SAP change document logging for the affected objects. Because the vulnerability involves overwriting another user's data, change logs can help detect unauthorized modifications.
Enable the SAP Security Audit Log with transactions SM19/SM20 to track report generation activities and correlate them with user sessions.

Affected Systems and Versions

The vulnerability affects the SAP Application Server ABAP component at the SAP_BASIS layer. These specific versions are confirmed affected:

SAP_BASIS 700
SAP_BASIS 701
SAP_BASIS 702
SAP_BASIS 731
SAP_BASIS 740
SAP_BASIS 750
SAP_BASIS 751
SAP_BASIS 752
SAP_BASIS 753
SAP_BASIS 754
SAP_BASIS 755
SAP_BASIS 756
SAP_BASIS 757
SAP_BASIS 758
SAP_BASIS 816

The range runs from SAP NetWeaver 7.0 through the latest SAP_BASIS releases, so virtually all actively maintained SAP ABAP systems are potentially affected. Organizations running any of these SAP_BASIS versions should make applying SAP Security Note 3735546 a priority.

Vendor Security History

SAP's 2026 Security Patch Day history shows a persistent pattern of CWE-862 (Missing Authorization) vulnerabilities in the ABAP platform:

Month	Total Notes	Notable ABAP Authorization CVEs
January 2026	17	Multiple authorization flaws, 4 Critical (CVSS 9.1 to 9.9)
February 2026	26	CVE-2026-0509: Missing auth check in ABAP RFC
March 2026	15	Authorization flaws noted
April 2026	20	CVE-2026-34256: Missing auth check in report generation (CVSS 7.1)
May 2026	15	Supply chain attack vector, 2 Critical
June 2026	Pending	CVE-2026-44751: Missing auth check in report generation (CVSS 7.1)

The April 2026 vulnerability, CVE-2026-34256, is a direct predecessor. It had the same CVSS score (7.1), the same CWE classification (CWE-862), and the same attack pattern (overwriting ABAP reports through missing authorization checks). Its fix patched specific ABAP programs to enforce proper authorization validation, and SAP Note 3735546 applies the equivalent enforcement for CVE-2026-44751.

Outside the CWE-862 pattern, CVE-2025-42957 (CVSS 9.9) was confirmed exploited in the wild in September 2025, which shows that SAP ABAP vulnerabilities are not theoretical risks. SecurityWeek reported that this critical SAP S/4HANA code injection flaw "allowing full system takeover has been exploited in the wild." That precedent is the reason to treat the current period for CVE-2026-44751 as a pre-exploitation window and to patch before threat actors develop exploits.

The repeated authorization bypass flaws suggest a systemic problem in SAP's ABAP development process, likely tied to the manual nature of AUTHORITY-CHECK enforcement and the sheer volume of ABAP code across the platform. Organizations should invest in automated ABAP code scanning with SAP Code Inspector (SCI) or ABAP Test Cockpit (ATC) to find missing AUTHORITY-CHECK statements before an attacker does, rather than relying only on monthly vendor patches.

Brief Summary: CVE-2026-44751 — SAP ABAP Missing Authorization Check Enables Privilege Escalation via Report Generation

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information