The vulnerability CVE-2026-44769 in SAP S/4HANA Project Management (PPM-PRO) involves improper neutralization of special elements used in SQL commands (CWE-89). It permits an attacker with high privileges to execute crafted database queries, potentially exposing sensitive data from the backend database. The impact is limited to confidentiality, with no integrity or availability compromise. The CVSS 3.1 base score is 5.5 (medium severity), reflecting network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. Affected versions include specific releases such as 602, 603, 604, 605, 606, 617, 618, 103, 104, 105, 106, 107, 108, 450_700, 500_702, and 610_740. No patch or official remediation level is indicated in the vendor data, and no known exploits are reported in the wild.

An attacker with high privileges can execute crafted SQL queries on the backend database, leading to exposure of confidential data. There is no impact on the integrity or availability of the application. The confidentiality impact is rated high, while integrity and availability impacts are low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor SAP advisories for updates. Restricting high privilege access and reviewing database query permissions may reduce risk until a patch is available.