Co-founder and CTO of RedRays
SAP security note 2023449, “Switchable authorization checks for RFC in FI, FI-AP-AP, FI-AR-AR, FI-BL-MD-BK”, is a program error note. Below is the security information published by SAP for this note.
Full note on SAP: SAP Support Launchpad note 2023449
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.
CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.
CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.
CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.