cyber.hendryadrian.com
Security News · securityweek.com

SAP Patches Four Critical Vulnerabilities in NetWeaver, Commerce and Data Hub

· Original article ↗

Summary

SAP released 15 security notes, including fixes for four critical flaws in NetWeaver, Commerce Cloud and Data Hub. Issues include SAML identity tampering, RFC-related memory corruption, missing Spring Security headers and directory traversal.

Key points

  • SAP released 15 security notes, including fixes for four critical-severity vulnerabilities.
  • CVE-2026-44748 (CVSS 9.9) affects SAML authentication in NetWeaver AS ABAP and ABAP Platform; an authenticated attacker could tamper with signed identity information. Disabling SAML authentication is a temporary mitigation.
  • CVE-2026-27671 (CVSS 9.8) is a memory-corruption flaw in NetWeaver and ABAP Platform that could be targeted by unauthenticated attackers with crafted RFC requests.
  • CVE-2026-22732 (CVSS 9.1) concerns Spring Security response headers that may not be written in affected applications, including those in Commerce Cloud and Data Hub.
  • CVE-2026-40128 (CVSS 9.0) is an unauthenticated directory-traversal flaw in NetWeaver Application Server Java that could expose sensitive information or cause denial of service.
  • Other SAP notes address multiple Apache Tomcat flaws in Commerce Cloud and a missing authorization check in NetWeaver and ABAP Platform.

Article Details

Event Type
SAP released 15 security notes, including patches for four critical vulnerabilities affecting NetWeaver, Commerce, and Data Hub.
Impact
The vulnerabilities could allow identity tampering that exposes sensitive user data or disrupts system use, unauthenticated memory-corruption attacks, and directory traversal that exposes sensitive information or causes denial of service. A Spring Security flaw could prevent HTTP response headers from being written.

CVE

CVE-2026-22732Vmware · Spring securityAffecting Commerce Cloud and Data Hub, the third critical-severity weakness that SAP resolved this week is CVE-2026-22732 (CVSS score of 9.1), which impacts all applications that rely on the Spring Security framework.CVE-2026-27671Vendor / Product unavailableThe second critical-severity flaw patched on SAP’s June 2026 security patch day is CVE-2026-27671 (CVSS score of 9.8), a memory corruption issue in NetWeaver and ABAP Platform.CVE-2026-40128Vendor / Product unavailableTracked as CVE-2026-40128 (CVSS score of 9.0), the issue allows unauthenticated attackers to send malicious HTTP logon requests, manipulating file inclusion parameters and allowing the attacker to access sensitiveCVE-2026-44748Vendor / Product unavailableThe most severe of the resolved bugs is CVE-2026-44748 (CVSS score of 9.9), described as an XML Signature Wrapping issue in the SAML Authentication of NetWeaver AS ABAP and ABAP Platform.

Vendors

SAPEnterprise software maker SAP on Tuesday released 15 new security notes, including four that resolve critical-severity vulnerabilities in NetWeaver, Commerce, and Data Hub.

Products

ABAP PlatformThe most severe of the resolved bugs is CVE-2026-44748 (CVSS score of 9.9), described as an XML Signature Wrapping issue in the SAML Authentication of NetWeaver AS ABAP and ABAP Platform.Adobe CommerceEnterprise software maker SAP on Tuesday released 15 new security notes, including four that resolve critical-severity vulnerabilities in NetWeaver, Commerce, and Data Hub.Apache TomcatOn Tuesday, SAP also released a high-severity security note resolving multiple Apache Tomcat flaws in Commerce Cloud, and another to address a missing authorization check in NetWeaver and ABAP Platform.NetWeaver AS ABAPThe most severe of the resolved bugs is CVE-2026-44748 (CVSS score of 9.9), described as an XML Signature Wrapping issue in the SAML Authentication of NetWeaver AS ABAP and ABAP Platform.SAP Commerce CloudAffecting Commerce Cloud and Data Hub, the third critical-severity weakness that SAP resolved this week is CVE-2026-22732 (CVSS score of 9.1), which impacts all applications that rely on the Spring Security framework.SAP Data HubEnterprise software maker SAP on Tuesday released 15 new security notes, including four that resolve critical-severity vulnerabilities in NetWeaver, Commerce, and Data Hub.SAP NetWeaverEnterprise software maker SAP on Tuesday released 15 new security notes, including four that resolve critical-severity vulnerabilities in NetWeaver, Commerce, and Data Hub.Spring SecurityAffecting Commerce Cloud and Data Hub, the third critical-severity weakness that SAP resolved this week is CVE-2026-22732 (CVSS score of 9.1), which impacts all applications that rely on the Spring Security framework.

Related Articles