SAP Patches Critical NetWeaver, Approuter, and Commerce Cloud Flaws (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761)

SAP Patches Critical NetWeaver, Approuter, and Commerce (TL-2026-1302), also tracked as SAP July 2026 Security Patch Day, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-07-14. It has no confirmed attribution, affects SAP NetWeaver Application Server ABAP / ABAP Platform (Kernel), references 11 CVEs (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761), maps to 23 MITRE ATT&CK techniques (T1036.005, T1046, T1059.004), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1302

Threat ID
TL-2026-1302
Also known as
SAP July 2026 Security Patch Day
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
manufacturing, finance, retail, government administration, energy, health, technology, logistics
Target regions
Global, North America, Europe, Asia Pacific
Detection rules
9
Indicators of compromise
27

Malware and tooling in SAP Patches Critical NetWeaver, Approuter, and Commerce

Malware and tooling: AgendaCrypt, Bianlian, RansomEXX, xmrig

SAP's July 2026 Security Patch Day fixes three critical (CVSS 9.1-9.9) vulnerabilities: an authenticated out-of-bounds write / memory corruption flaw in NetWeaver Application Server ABAP (CVE-2026-44747), an unauthenticated HTTP request smuggling flaw in SAP Approuter (CVE-2026-27690), and a default/sample-credential flaw in Commerce Cloud that lets attackers obtain valid OAuth2 access tokens (CVE-2026-44761). No active exploitation is confirmed for these three CVEs as of the advisory date, but SAP infrastructure is a recurring, high-value target: CISA has catalogued 14 SAP CVEs as exploited-in-the-wild since November 2021, and the most recent, CVE-2025-31324 (NetWeaver Visual Composer unrestricted file upload), was actively exploited by Russian-speaking ransomware affiliates (Qilin, BianLian, RansomEXX).

How SAP Patches Critical NetWeaver, Approuter, and Commerce works

On its July 2026 Security Patch Day, SAP released 16 security notes (3 critical, 6 high, 7 medium, 1 low), including three HotNews/Critical-rated fixes that stand out for their pre-authentication or low-privilege reachability against internet-facing SAP components.

CVE-2026-44747 (SAP Security Note 3747367, CWE-787 Out-of-Bounds Write, CVSS 3.1 base 9.9) affects SAP NetWeaver Application Server ABAP and ABAP Platform kernel across a wide range of releases (KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16 through 9.20). An authenticated attacker holding only low (normal-user) privileges can trigger logical errors in ABAP kernel memory management that corrupt process memory, with a high impact on confidentiality, integrity, and availability. Because the ABAP kernel underpins nearly every classic SAP business application (ERP, S/4HANA on-prem, BW), a successful trigger can lead to unauthorized data access, data tampering, potential privilege escalation, and full application-server crashes/DoS across dependent business processes.

CVE-2026-27690 affects SAP Approuter, the Node.js reverse-proxy middleware that fronts SAP Business Technology Platform (BTP) Cloud Foundry applications, in versions earlier than 20.10.0 (CVSS 3.1 base 9.1). The flaw is an HTTP request smuggling vulnerability reachable by a completely unauthenticated attacker who sends a specially crafted HTTP request that desynchronizes how the front-end proxy and back-end application parse request boundaries (classic CL.TE / TE.CL smuggling class). A successful smuggle can hijack or poison another user's HTTP response (leaking session data, tokens, or otherwise-private application responses), bypass front-end access-control/WAF logic that assumes request/response pairing, or induce denial-of-service by desynchronizing the connection queue. Because Approuter is the internet-facing ingress for BTP multi-tenant SaaS extensions, this is a network-perimeter-exposed bug with no authentication prerequisite.

CVE-2026-44761 affects SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21) (CVSS 3.1 base 9.1, CWE class: use of hard-coded/default credentials). The product ships or retains a sample OAuth2 client whose client_id/client_secret pair is publicly documented in SAP Help Portal reference material for demo/sample configuration. If an administrator does not rotate these documented sample credentials post-deployment, an unauthenticated attacker can request an OAuth2 access token using the published sample client and use that token to call Commerce Cloud OCC/Admin APIs to read and modify commerce data (catalogs, customer data, orders), with high confidentiality and integrity impact and no direct availability impact.

None of the three 2026-Jul CVEs had confirmed in-the-wild exploitation at disclosure time. However, SAP products are a standing ransomware and espionage target: CISA's KEV catalog lists 14 SAP vulnerabilities as exploited since November 2021, including CVE-2017-12637 (NetWeaver directory traversal), CVE-2019-0344 (Commerce Cloud deserialization), CVE-2025-42999 (NetWeaver deserialization), and most notably CVE-2025-31324 (NetWeaver Visual Composer unrestricted file upload, actively exploited pre-patch by threat actors linked to the Russian-speaking ransomware ecosystem — Qilin RaaS affiliates, plus reporting connecting exploitation activity to BianLian and RansomEXX). This precedent — pre-auth or default-credential SAP internet-facing components being weaponized within weeks of disclosure by opportunistic and ransomware-affiliated actors — is the primary reason these three July 2026 flaws warrant detection coverage and rapid patch prioritization even absent confirmed exploitation.

The June 2026 SAP Patch Day (the preceding month) followed the same pattern: four HotNews vulnerabilities including CVE-2026-44748 (XML Signature Wrapping in SAML auth for NetWeaver AS ABAP, CVSS 9.9), CVE-2026-27671 (unauthenticated RFC-based memory corruption in the NetWeaver kernel, CVSS 9.8), CVE-2026-40128 (unauthenticated directory traversal via malicious HTTP logon request in NetWeaver AS Java, CVSS 9.0), and CVE-2026-22732 (missing HTTP security headers / Spring Security misconfiguration affecting SAP Commerce Cloud and Data Hub, CVSS 9.1) — underscoring that NetWeaver kernel memory corruption and Commerce Cloud misconfiguration are recurring, month-over-month vulnerability classes for SAP, not one-off findings.

MITRE ATT&CK techniques used in TL-2026-1302

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Initial Access

T1078.001 Default Accounts; T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Collection

T1213 Data from Information Repositories

Impact

T1496 Resource Hijacking; T1499.003 Application Exhaustion Flood; T1565.001 Stored Data Manipulation

Persistence

T1505.003 Web Shell

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in SAP Patches Critical NetWeaver, Approuter, and Commerce

  • SAP — NetWeaver Application Server ABAP / ABAP Platform (Kernel)
    Vulnerable versions: KRNL64NUC 7.22; KRNL64NUC 7.22EXT; KRNL64UC 7.22; KRNL64UC 7.53; KRNL64UC 7.54; KRNL64UC 7.77; KRNL64UC 7.89; KRNL64UC 7.93; KRNL64UC 9.16; KRNL64UC 9.17
    Fixed in: Patched per SAP Security Note 3747367
  • SAP — SAP Approuter (Node.js middleware for SAP BTP)
    Vulnerable versions: < 20.10.0
    Fixed in: 20.10.0 and later
  • SAP — SAP Commerce Cloud
    Vulnerable versions: HY_COM 2205; COM_CLOUD 2211; COM_CLOUD 2211-JDK21
    Fixed in: Patched / sample credentials rotated per SAP guidance

Remediation for SAP Patches Critical NetWeaver, Approuter, and Commerce

Patches

  • SAP Security Note 3747367 — NetWeaver AS ABAP kernel patch (CVE-2026-44747)
  • SAP Approuter npm package upgrade to >=20.10.0 (CVE-2026-27690)
  • SAP Commerce Cloud patch/credential-rotation guidance for CVE-2026-44761

Immediate actions

  • Apply SAP Security Note 3747367 (CVE-2026-44747) to all affected ABAP kernel releases (KRNL64NUC 7.22/7.22EXT; KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16-9.20)
  • Upgrade SAP Approuter to version 20.10.0 or later to remediate CVE-2026-27690
  • Rotate/disable the sample OAuth2 client credentials documented in SAP Help Portal for SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211, 2211-JDK21) to remediate CVE-2026-44761
  • Audit NetWeaver, Approuter, and Commerce Cloud instances for internet exposure and restrict access via network segmentation/allow-listing pending patch rollout
  • Review SAP Gateway/ICM and OAuth2 access logs for anomalous authentication using default/sample client IDs

Workarounds

  • Restrict NetWeaver ABAP RFC/HTTP interfaces to trusted internal networks until patched
  • Place Approuter behind an additional reverse proxy configured to reject malformed/ambiguous HTTP request framing
  • Manually disable or rotate the documented sample OAuth2 client in Commerce Cloud identity provider configuration

Longer-term hardening

  • Deploy SAP-aware WAF/reverse-proxy rules to normalize and reject ambiguous HTTP framing (Content-Length/Transfer-Encoding conflicts) ahead of Approuter
  • Implement credential-rotation policy and secrets scanning for all SAP sample/demo configuration artifacts before go-live
  • Deploy SIEM correlation rules mapped to SAP Read Access Logging (RAL) and Security Audit Log (SAL) for ABAP kernel anomalies
  • Establish a recurring SAP Patch Day review cadence (monthly) with prioritized patching SLAs for HotNews/Critical notes
  • Onboard SAP landscape to a dedicated SAP security monitoring platform (e.g., Onapsis, SecurityBridge) for continuous vulnerability and threat detection

CVEs associated with SAP Patches Critical NetWeaver, Approuter, and Commerce

CVE-2026-44747, CVE-2026-27690, CVE-2026-44761, CVE-2025-31324, CVE-2025-42999, CVE-2017-12637, CVE-2019-0344, CVE-2026-44748, CVE-2026-27671, CVE-2026-40128, CVE-2026-22732

Weaknesses (CWE) in SAP Patches Critical NetWeaver, Approuter, and Commerce

CWE-787, CWE-444, CWE-798, CWE-772

Timeline of SAP Patches Critical NetWeaver, Approuter, and Commerce

  • CISA begins cataloguing SAP vulnerabilities as Known Exploited Vulnerabilities; 14 SAP CVEs added to the KEV catalog to date, underscoring SAP as a persistent exploitation target
  • Onapsis threat brief documents the full CVE-2025-31324 attack chain: mass internet scanning, unauthenticated exploitation of /developmentserver/metadatauploader via a Java deserialization gadget chain, deployment of JSP webshells (helper.jsp, cache.jsp, coresap.jsp, forwardsap.jsp, webhelp.jsp, randomized 8-char names) under the <sid>adm OS user, reconnaissance of SecStore.properties, lateral movement to interconnected SAP systems, and secondary opportunistic attackers abusing established webshells to deploy XMRig coin-miners; Forescout attributed one wave to a China-based actor, Trend Micro linked infrastructure to the China-nexus APT group Earth Lamia
  • CVE-2025-31324 (NetWeaver Visual Composer unrestricted file upload) actively exploited pre-patch; activity linked to Russian-speaking ransomware affiliates including Qilin, BianLian, and RansomEXX
  • SAP June 2026 Security Patch Day releases four HotNews notes (CVE-2026-44748, CVE-2026-27671, CVE-2026-40128, CVE-2026-22732) affecting NetWeaver ABAP/Java and Commerce Cloud/Data Hub
  • Cyber Security Agency of Singapore (CSA) issues advisory AL-2026-075 on the critical SAP NetWeaver and Commerce Cloud vulnerabilities
  • BleepingComputer and SecurityWeek report on the July 2026 SAP Security Patch Day, noting no confirmed active exploitation of the three critical CVEs at time of publication
  • SAP publishes guidance to rotate the sample OAuth2 client credentials in Commerce Cloud to remediate CVE-2026-44761
  • SAP publishes guidance to upgrade Approuter to version 20.10.0+ to remediate the HTTP request smuggling flaw (CVE-2026-27690)
  • SAP Security Note 3747367 published, patching the NetWeaver AS ABAP kernel out-of-bounds write (CVE-2026-44747)
  • SAP July 2026 Security Patch Day publishes 16 security notes (3 critical, 6 high, 7 medium, 1 low), including CVE-2026-44747, CVE-2026-27690, and CVE-2026-44761

Sources cited for SAP Patches Critical NetWeaver, Approuter, and Commerce

Threats related to SAP Patches Critical NetWeaver, Approuter, and Commerce

Detection coverage for TL-2026-1302

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1302 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats