SAP has released its July 2026 security updates addressing multiple critical vulnerabilities across its enterprise software portfolio, headlined by a CVSS 9.9 memory corruption flaw in SAP NetWeaver Application Server ABAP that could allow authenticated attackers to read, modify, or destroy sensitive business data.
Vulnerability Details
The centerpiece of this month's release is CVE-2026-44747 (CVSS 9.9), an out-of-bounds write vulnerability in the ABAP kernel's memory management subsystem. The flaw stems from improper bounds checking when processing certain internal table operations, allowing an authenticated user with relatively low privileges to corrupt heap memory and achieve arbitrary code execution or data manipulation.
| CVE ID | Component | CVSS | Attack Vector | Authentication | Impact |
|---|---|---|---|---|---|
| CVE-2026-44747 | NetWeaver AS ABAP (Kernel) | 9.9 | Network | Required (Low) | Critical: RCE, Data Theft, DoS |
| CVE-2026-27690 | SAP Approuter (non-CF) | 9.1 | Network | None | Critical: Request Smuggling, DoS |
| CVE-2026-44761 | SAP Commerce Cloud | 9.1 | Network | None | Critical: Default Credentials, Data Access |
| CVE-2026-44752 | NetWeaver AS Java Config Wizard | 8.3 | Network | Required | High: Stored XSS |
| CVE-2026-58233 | Change & Transport System Attach Tool | 7.8 | Local | Required | High: RCE (Deprecated Tool) |
| CVE-2026-0487 | SAProuter | 7.8 | Local | Required | High: DLL Hijacking |
Additional vulnerabilities patched include multiple flaws in Apache Camel integration (CVE-2026-40453, CVE-2026-33454), SAP Integration Suite components, and NetWeaver AS Java administration interfaces.
Impact Assessment
Who Is Affected
Organizations running any of the following are at risk:
- SAP NetWeaver Application Server ABAP (all supported kernel versions prior to the July 2026 patch)
- SAP Approuter deployments not running on Cloud Foundry
- SAP Commerce Cloud instances that may have imported sample OAuth client configurations
- SAP NetWeaver Application Server Java systems with the configuration wizard accessible
- SAProuter installations on Windows hosts
The NetWeaver ABAP flaw (CVE-2026-44747) is particularly concerning because it affects the core kernel used across SAP ERP, S/4HANA, BW, and custom ABAP applications. Any system where users can execute ABAP code — including developers, power users, and compromised service accounts — can potentially exploit this vulnerability.
Business Risk
A successful exploit of CVE-2026-44747 could result in:
- Complete data compromise: Access to financial records, customer PII, supply chain data, and intellectual property
- System takeover: Kernel-level code execution enabling persistence, lateral movement, and ransomware deployment
- Operational disruption: Denial of service via memory corruption crashes
- Compliance violations: GDPR, SOX, and industry-specific regulatory exposure
The request smuggling flaw (CVE-2026-27690) in Approuter allows unauthenticated attackers to poison HTTP request/response pipelines, potentially hijacking user sessions or causing cascading DoS across microservice architectures.
The Commerce Cloud default credentials issue (CVE-2026-44761) stems from sample OAuth 2.0 client configurations documented in the SAP Help Portal. Organizations that executed these sample scripts in production without rotating the hard-coded secrets are vulnerable to unauthenticated API access.
Affected Systems and Versions
SAP has released corrected kernel versions and support package stacks. The minimum patched versions are:
| Product | Minimum Patched Version |
|---|---|
| SAP NetWeaver AS ABAP Kernel | 7.22 PL 2000+, 7.49 PL 1000+, 7.53 PL 2000+, 7.89 PL 1000+, 7.91 PL 500+, 7.93 PL 200+ |
| SAP Approuter | @sap/approuter v18.2.0+ |
| SAP Commerce Cloud | 2211.18+, 2305.12+, 2311.6+ |
| SAP NetWeaver AS Java | 7.50 SP 30+, 7.51 SP 20+ |
| SAProuter | 7.21 PL 800+ |
Customers should consult SAP Note 3489211 (July 2026 Security Patch Day Overview) for the complete matrix of affected products, support package levels, and download links.
Mitigation and Patching
Immediate Workarounds
For organizations unable to apply patches immediately, SAP and Onapsis recommend:
For CVE-2026-44747 (NetWeaver ABAP):
For CVE-2026-27690 (Approuter):
- Migrate Approuter deployments to Cloud Foundry environment
- Implement strict HTTP request validation at the reverse proxy layer
For CVE-2026-44761 (Commerce Cloud):
Patching Priority
- Priority 1 (Patch within 72 hours): CVE-2026-44747, CVE-2026-27690, CVE-2026-44761
- Priority 2 (Patch within 2 weeks): CVE-2026-44752, CVE-2026-0487
- Priority 3 (Next maintenance window): Remaining medium-severity flaws
Patch Application Process
Detection and Threat Hunting
Log Analysis Queries
Splunk / Elastic / Sentinel:
IOC Collection
| Indicator | Type | Context |
|---|---|---|
| Unusual kernel memory allocation patterns | Behavioral | CVE-2026-44747 exploitation |
| HTTP requests with both CL and TE headers | Network | CVE-2026-27690 request smuggling |
| OAuth token requests for "sample" clients | Auth | CVE-2026-44761 default credentials |
| SAProuter DLL loads from non-standard paths | Endpoint | CVE-2026-0487 DLL hijacking |
YARA Rule for Kernel Exploit Artifacts
Frequently Asked Questions
Q: Does CVE-2026-44747 require administrative privileges? A: No. Any authenticated ABAP user with the ability to execute custom code (developers, power users, batch accounts) can potentially exploit this. The vulnerability is in the kernel's memory management, not in authorization checks.
Q: Is there evidence of active exploitation? A: As of July 14, 2026, there are no public reports of exploitation in the wild. However, the CVSS 9.9 rating and kernel-level nature make it a prime target for advanced threat actors.
Q: Can I mitigate CVE-2026-44747 without breaking SAP GUI for HTML? A: The ICF node workaround disables the HTML-based GUI. Alternative mitigations include restricting ABAP development authorizations (S_DEVELOP) to minimal required users and enabling kernel-level memory protection flags where supported.
Q: How do I check if my Commerce Cloud has the default OAuth client? A: Query the OAuth client registry via the Commerce Cloud API or Backoffice Administration Cockpit. Search for client IDs containing "sample", "demo", or "test" with creation dates matching your initial implementation.
Q: Are S/4HANA Cloud customers affected? A: SAP manages patching for S/4HANA Cloud. The July 2026 patches were applied to cloud tenants during the maintenance window of July 12-13. Verify with your SAP Cloud ALM dashboard.
Q: What about the deprecated Change & Transport System Attach Tool (CVE-2026-58233)? A: This tool has been deprecated since 2022. If still present, uninstall it immediately. The vulnerability requires local access and is lower risk than the network-exposed flaws.
Key Takeaways
-
CVE-2026-44747 is the highest-severity SAP kernel flaw in years — a CVSS 9.9 memory corruption vulnerability affecting the ABAP runtime used by virtually all SAP ERP and S/4HANA systems.
-
Three critical vulnerabilities require emergency patching — the NetWeaver ABAP kernel flaw, Approuter request smuggling, and Commerce Cloud default credentials all carry CVSS 9.1+ and are exploitable over the network.
-
Workarounds exist but carry operational cost — disabling ICF nodes breaks SAP GUI for HTML; migrating Approuter to Cloud Foundry requires architecture changes.
-
Detection is possible with existing log sources — ABAP runtime logs, web access logs, and OAuth audit trails can reveal exploitation attempts.
-
Supply chain risk extends to sample code — the Commerce Cloud flaw originated from documented sample configurations, highlighting the danger of shipping production-ready defaults in documentation.
Conclusion
SAP's July 2026 Patch Day delivers a sobering reminder that enterprise application layers remain a high-value attack surface. The CVSS 9.9 NetWeaver ABAP kernel flaw (CVE-2026-44747) represents a near-worst-case scenario: a memory safety bug in the core runtime that underpins mission-critical business logic across thousands of organizations.
Security teams should prioritize the three critical CVEs for emergency patching within 72 hours, implement the detection queries above to hunt for post-exploitation activity, and audit their SAP landscapes for lingering sample configurations and deprecated components.
The era of treating ERP security as "someone else's problem" is over. These systems process the financial, operational, and human capital data that define modern enterprises — they deserve the same rigor as your cloud infrastructure and endpoint defenses.
Sources:
- SAP Security Patch Day July 2026 Official Notes
- The Hacker News: SAP Patches CVSS 9.9 NetWeaver ABAP Flaw
- Onapsis Blog: SAP Security Patch Day July 2026 Analysis
- SOCRadar: SAP Security Patch Day July 2026 Fixes Critical NetWeaver CVE-2026-44747
- NVD: CVE-2026-44747
- NVD: CVE-2026-27690
- NVD: CVE-2026-44761
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.