cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

SAP Patches Critical NetWeaver and Commerce Cloud Flaws

· Original article ↗

Summary

SAP’s June 2026 security package fixes 15 flaws, including four critical issues in NetWeaver and Commerce Cloud. The flaws include SAML authentication bypass, unauthenticated memory corruption, a Spring Security issue, and directory traversal.

Key points

  • SAP’s June 2026 security package addresses 15 vulnerabilities, including four critical flaws in NetWeaver and Commerce Cloud.
  • CVE-2026-44748 is an XML signature-wrapping flaw that may allow tampered identity information to be accepted in SAML-based environments.
  • CVE-2026-27671 can reportedly be exploited without authentication through crafted RFC requests to cause memory corruption.
  • CVE-2026-22732 affects Spring Security in Commerce Cloud and SAP Data Hub; CVE-2026-40128 is a directory traversal flaw in NetWeaver Application Server Java.
  • SAP also patched high-severity issues involving Apache Tomcat flaws and a missing authorization check, plus other vulnerabilities across its products.
  • SAP says detailed flaw information and mitigation advice or workarounds are available to customers with a security portal account.

Article Details

Vulnerability Types
  • XML Signature Wrapping that may enable authentication bypass
  • Memory corruption
  • Spring Security-related vulnerability
  • Directory traversal
  • Apache Tomcat vulnerabilities
  • Missing authorization check
Severity
Four critical vulnerabilities (CVSS 9.0–9.9); two additional high-severity vulnerabilities.
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-22732Vmware · Spring securityCVE-2026-22732 (CVSS 9.1) – Spring Security-related vulnerability affecting SAP Commerce Cloud and SAP Data Hub.CVE-2026-27671Vendor / Product unavailableOrganizations using these products should prioritize patching CVE-2026-44748 and CVE-2026-27671 due to their high severity and potential impact on enterprise environments.CVE-2026-29145Apache · Tomcat; Apache · Tomcat nativeCVE-2026-29145 comprises multiple Apache Tomcat flaws impacting Commerce Cloud, and CVE-2026-44751, which is a missing authorization check issue in NetWeaver AS ABAP.CVE-2026-40128Vendor / Product unavailableCVE-2026-40128 (CVSS 9.0) – Directory traversal vulnerability in SAP NetWeaver Application Server Java’s Web Container.CVE-2026-44748Vendor / Product unavailableOrganizations using these products should prioritize patching CVE-2026-44748 and CVE-2026-27671 due to their high severity and potential impact on enterprise environments.CVE-2026-44751Vendor / Product unavailableCVE-2026-29145 comprises multiple Apache Tomcat flaws impacting Commerce Cloud, and CVE-2026-44751, which is a missing authorization check issue in NetWeaver AS ABAP.

Vendors

SAPSAP’s June 2026 Security Patch package fixes 15 vulnerabilities, including four critical flaws in SAP NetWeaver and SAP Commerce Cloud that could enable authentication bypass, memory corruption, and directory traversal

Products

Apache TomcatCVE-2026-29145 comprises multiple Apache Tomcat flaws impacting Commerce Cloud, and CVE-2026-44751, which is a missing authorization check issue in NetWeaver AS ABAP.SAP Commerce CloudSecurity Patch package fixes 15 vulnerabilities, including four critical flaws in SAP NetWeaver and SAP Commerce Cloud that could enable authentication bypass, memory corruption, and directory traversal attacks.SAP Data HubCVE-2026-22732 (CVSS 9.1) – Spring Security-related vulnerability affecting SAP Commerce Cloud and SAP Data Hub.SAP NetWeaverSAP’s June 2026 Security Patch package fixes 15 vulnerabilities, including four critical flaws in SAP NetWeaver and SAP Commerce Cloud that could enable authentication bypass, memory corruption, and directory traversal

Related Articles