CVE-2026-44754
MediumCVSS 6.6Summary
The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification of permitted SAP-internal applications, which could lead to unintended disclosure of data.
Risk Assessment
The lack of proper caller identification may result in the exposure of sensitive information, but it does not affect data integrity and poses minimal availability concerns for the application.
Recommendation
It is recommended to implement caller identification mechanisms and restrict access to RFC modules only for authorized SAP internal applications.
Original NVD description (English source)
The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification of permitted SAP-internal applications and are being used by customer or third-party applications in ways that are not aligned with its intended usage. Which could lead to unintended disclosure of data, but does not affect integrity, and poses minimal availability concerns for the application.