SAP Gtw ErrMsg Injection Exposes URI Parse Logic
CVE-2026-44749 Published on May 26, 2026

Information Disclosure vulnerability in SAP Gateway
The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.

NVD

Vulnerability Analysis

CVE-2026-44749 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Exposure of Sensitive System Information to an Unauthorized Control Sphere

The application does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the application does.


Products Associated with CVE-2026-44749

Want to know whenever a new CVE is published for SAP Gateway? stack.watch will email you.

SAP Gateway
 

Affected Versions

SAP_SE SAP Gateway: