CVE-2026-44744 is an SQL injection vulnerability (CWE-89) in SAP S/4HANA (On-Premise) versions 103 through 109. It exists in a remote-enabled function module component and can be exploited by an authenticated attacker to execute unauthorized database queries, potentially exposing sensitive information. The vulnerability affects confidentiality but does not impact integrity or availability. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and required privileges. No vendor advisory or patch information is available at this time.

An authenticated attacker can exploit this SQL injection vulnerability to access sensitive information from the database that they should not have access to. There is no impact on the integrity or availability of the application. The confidentiality breach could lead to unauthorized disclosure of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor SAP's security advisories for updates. In the meantime, restrict access to the vulnerable function modules to trusted users only and apply principle of least privilege to limit potential exploitation.