VulnerabilityAwaiting Analysis

CVE-2026-44749

The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic.

MEDIUM 4.3EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-497
Source: cna@sap.com

References

https://me.sap.com/notes/3433366
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.