The vulnerability CVE-2026-44754 involves missing authorization checks in the RFC modules of SAP SE's ODP Data Replication APIs. Specifically, these modules do not verify the caller identity to restrict usage to permitted SAP-internal applications. As a result, external customer or third-party applications can invoke these APIs beyond their intended scope, potentially causing unintended data disclosure. The vulnerability does not compromise data integrity and poses minimal availability risks. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

Exploitation of this vulnerability could lead to unauthorized disclosure of data accessible via the ODP Data Replication APIs. Integrity of the data is not affected, and availability impact is minimal. The CVSS 3.1 base score is 6.6 (medium severity), reflecting network attack vector, high complexity, high privileges required, no user interaction, and a confidentiality impact rated as high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided by SAP SE, organizations should review and restrict access to the ODP Data Replication APIs to trusted internal applications only, ensuring that customer and third-party applications cannot misuse these interfaces.