SAP patches 16 flaws in July updates, including three critical vulnerabilities
Summary
SAP’s July 2026 security updates fix 16 vulnerabilities, including three critical flaws in NetWeaver, Approuter, and Commerce Cloud. SAP says it has no evidence the flaws have been exploited.
Key points
- SAP fixed 16 vulnerabilities: three critical, six high-severity, seven medium-severity, and one low-severity.
- CVE-2026-44747 affects NetWeaver AS ABAP; an authenticated attacker could cause memory corruption, potentially enabling data access or modification, or system unavailability.
- Unauthenticated attackers could exploit CVE-2026-27690 in SAP Approuter with crafted HTTP requests to access user responses or cause denial of service.
- Default credentials involved in CVE-2026-44761 could let attackers obtain valid tokens and read or modify data through certain SAP Commerce Cloud APIs.
- SAP reports no evidence that the newly patched flaws have been exploited.
- CISA has added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities catalog since November 2021, including two abused by ransomware groups.
Article Details
- Event Type
- SAP released July 2026 security updates addressing 16 vulnerabilities, including three critical flaws.
- Impact
- The critical flaws could cause memory corruption and system unavailability in NetWeaver AS ABAP, enable HTTP request smuggling and denial of service in SAP Approuter, and allow access to Commerce Cloud APIs using default credentials to read or modify data. SAP reported no evidence that the vulnerabilities had been exploited.
CVE
Vendors
Products
NetWeaver AS ABAPSAP’s July 2026 security updates address 16 vulnerabilities across multiple products, including critical flaws in NetWeaver AS ABAP, SAP Approuter, and SAP Commerce Cloud.SAP ApprouterSAP’s July 2026 security updates address 16 vulnerabilities across multiple products, including critical flaws in NetWeaver AS ABAP, SAP Approuter, and SAP Commerce Cloud.SAP Commerce CloudSAP’s July 2026 security updates address 16 vulnerabilities across multiple products, including critical flaws in NetWeaver AS ABAP, SAP Approuter, and SAP Commerce Cloud.