SAP Patches Critical NetWeaver ABAP Flaw and Two Other Vulnerabilities
Summary
SAP’s July 2026 updates address three critical flaws: memory corruption in NetWeaver ABAP, request/response smuggling in Approuter, and exposed sample credentials in Commerce Cloud. No in-the-wild exploitation was reported.
Key points
- CVE-2026-44747, rated CVSS 9.9, is an authenticated out-of-bounds write flaw in SAP NetWeaver Application Server ABAP that could cause memory corruption, data access or modification, or service unavailability.
- CVE-2026-27690 affects SAP Approuter deployments outside Cloud Foundry; a crafted unauthenticated request could cause desynchronization, expose user responses, or trigger denial of service.
- CVE-2026-44761 concerns SAP Commerce Cloud sample OAuth 2.0 clients with publicly documented default credentials; exploitation requires the sample client and unchanged secret to remain in production.
- SAP recommends removing affected sample clients or replacing their hard-coded secrets with strong, unique values, and applying the updates.
- The article reports no evidence that the vulnerabilities were exploited in the wild.
Article Details
- Vulnerability Types
- Out-of-bounds write
- HTTP request/response smuggling
- Use of default credentials
- Severity
- Critical; CVSS 9.9 for CVE-2026-44747 and CVSS 9.1 for CVE-2026-27690 and CVE-2026-44761
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-44747, disable all ICF nodes with the specified property in transaction SICF; the article notes this disables opening transactions in SAP GUI for HTML and may not suit all customers.
- For CVE-2026-44761, remove the affected sample OAuth 2.0 client or replace its hard-coded secret with a strong, unique value.
MITRE ATT&CK
T1078.001 · Default AccountsFor CVE-2026-44761, an unauthenticated attacker could use the publicly documented default credentials retained in a production OAuth 2.0 client to obtain an access token.T1550.001 · Application Access TokenFor CVE-2026-44761, an attacker could use the obtained OAuth 2.0 access token to invoke APIs and read or modify data.
CVE
CVE-2026-27690Sap · Approuter#SAPNetWeaverCVE-2026-44747Vendor / Product unavailableSAP’s July 2026 security updates fix multiple critical flaws, including CVE-2026-44747 in SAP NetWeaver Application Server ABAP, which could lead to memory corruption and unauthorized access.CVE-2026-44761Vendor / Product unavailable#SAPNetWeaver
Vendors
Products
SAP ApprouterThe patch set also addresses request smuggling in SAP Approuter and default-credential exposure in SAP Commerce Cloud tied to sample OAuth 2.0 client settings from SAP Help Portal documentation.SAP Commerce CloudThe patch set also addresses request smuggling in SAP Approuter and default-credential exposure in SAP Commerce Cloud tied to sample OAuth 2.0 client settings from SAP Help Portal documentation.SAP NetWeaver Application Server ABAPSAP’s July 2026 security updates fix multiple critical flaws, including CVE-2026-44747 in SAP NetWeaver Application Server ABAP, which could lead to memory corruption and unauthorized access.