# SAP Patches Critical NetWeaver, Approuter, and Commerce Cloud Flaws (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761)

> SAP's July 2026 Security Patch Day fixes three critical (CVSS 9.1-9.9) vulnerabilities: an authenticated out-of-bounds write / memory corruption flaw in NetWeaver Application Server ABAP (CVE-2026-44747), an unauthenticated HTTP request smuggling flaw in SAP Approuter (CVE-2026-27690), and a default/sample-credential flaw in Commerce Cloud that lets attackers obtain valid OAuth2 access tokens (CVE-2026-44761). No active exploitation is confirmed for these three CVEs as of the advisory date, but SAP infrastructure is a recurring, high-value target: CISA has catalogued 14 SAP CVEs as exploited-in-the-wild since November 2021, and the most recent, CVE-2025-31324 (NetWeaver Visual Composer unrestricted file upload), was actively exploited by Russian-speaking ransomware affiliates (Qilin, BianLian, RansomEXX).

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1302
- **ID:** TL-2026-1302
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-44747, CVE-2026-27690, CVE-2026-44761, CVE-2025-31324, CVE-2025-42999, CVE-2017-12637, CVE-2019-0344, CVE-2026-44748, CVE-2026-27671, CVE-2026-40128, CVE-2026-22732

## Description

On its July 2026 Security Patch Day, SAP released 16 security notes (3 critical, 6 high, 7 medium, 1 low), including three HotNews/Critical-rated fixes that stand out for their pre-authentication or low-privilege reachability against internet-facing SAP components.

CVE-2026-44747 (SAP Security Note 3747367, CWE-787 Out-of-Bounds Write, CVSS 3.1 base 9.9) affects SAP NetWeaver Application Server ABAP and ABAP Platform kernel across a wide range of releases (KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16 through 9.20). An authenticated attacker holding only low (normal-user) privileges can trigger logical errors in ABAP kernel memory management that corrupt process memory, with a high impact on confidentiality, integrity, and availability. Because the ABAP kernel underpins nearly every classic SAP business application (ERP, S/4HANA on-prem, BW), a successful trigger can lead to unauthorized data access, data tampering, potential privilege escalation, and full application-server crashes/DoS across dependent business processes.

CVE-2026-27690 affects SAP Approuter, the Node.js reverse-proxy middleware that fronts SAP Business Technology Platform (BTP) Cloud Foundry applications, in versions earlier than 20.10.0 (CVSS 3.1 base 9.1). The flaw is an HTTP request smuggling vulnerability reachable by a completely unauthenticated attacker who sends a specially crafted HTTP request that desynchronizes how the front-end proxy and back-end application parse request boundaries (classic CL.TE / TE.CL smuggling class). A successful smuggle can hijack or poison another user's HTTP response (leaking session data, tokens, or otherwise-private application responses), bypass front-end access-control/WAF logic that assumes request/response pairing, or induce denial-of-service by desynchronizing the connection queue. Because Approuter is the internet-facing ingress for BTP multi-tenant SaaS extensions, this is a network-perimeter-exposed bug with no authentication prerequisite.

CVE-2026-44761 affects SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21) (CVSS 3.1 base 9.1, CWE class: use of hard-coded/default credentials). The product ships or retains a sample OAuth2 client whose client_id/client_secret pair is publicly documented in SAP Help Portal reference material for demo/sample configuration. If an administrator does not rotate these documented sample credentials post-deployment, an unauthenticated attacker can request an OAuth2 access token using the published sample client and use that token to call Commerce Cloud OCC/Admin APIs to read and modify commerce data (catalogs, customer data, orders), with high confidentiality and integrity impact and no direct availability impact.

None of the three 2026-Jul CVEs had confirmed in-the-wild exploitation at disclosure time. However, SAP products are a standing ransomware and espionage target: CISA's KEV catalog lists 14 SAP vulnerabilities as exploited since November 2021, including CVE-2017-12637 (NetWeaver directory traversal), CVE-2019-0344 (Commerce Cloud deserialization), CVE-2025-42999 (NetWeaver deserialization), and most notably CVE-2025-31324 (NetWeaver Visual Composer unrestricted file upload, actively exploited pre-patch by threat actors linked to the Russian-speaking ransomware ecosystem — Qilin RaaS affiliates, plus reporting connecting exploitation activity to BianLian and RansomEXX). This precedent — pre-auth or default-credential SAP internet-facing components being weaponized within weeks of disclosure by opportunistic and ransomware-affiliated actors — is the primary reason these three July 2026 flaws warrant detection coverage and rapid patch prioritization even absent confirmed exploitation.

The June 2026 SAP Patch Day (the preceding month) followed the same pattern: four HotNews vulnerabilities including CVE-2026-44748 (XML Signature Wrapping in SAML auth for NetWeaver AS ABAP, CVSS 9.9), CVE-2026-27671 (unauthenticated RFC-based memory corruption in the NetWeaver kernel, CVSS 9.8), CVE-2026-40128 (unauthenticated directory traversal via malicious HTTP logon request in NetWeaver AS Java, CVSS 9.0), and CVE-2026-22732 (missing HTTP security headers / Spring Security misconfiguration affecting SAP Commerce Cloud and Data Hub, CVSS 9.1) — underscoring that NetWeaver kernel memory corruption and Commerce Cloud misconfiguration are recurring, month-over-month vulnerability classes for SAP, not one-off findings.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1203 Exploitation for Client Execution
- T1685 Disable or Modify Tools
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1565.001 Stored Data Manipulation
- T1499.003 Application Exhaustion Flood
- T1046 Network Service Discovery
- T1071.001 Web Protocols
- T1068 Exploitation for Privilege Escalation
- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1505.003 Web Shell
- T1059.004 Unix Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer
- T1496 Resource Hijacking

## Sources

- [SAP warns of critical flaws in NetWeaver and Commerce Cloud](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/)
- [SAP Patches Critical NetWeaver, Commerce Vulnerabilities](https://www.securityweek.com/sap-patches-critical-netweaver-commerce-vulnerabilities/)
- [Critical Vulnerabilities in SAP NetWeaver and SAP Commerce Cloud](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-075/)
- [SAP Security Patch Day - July 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html)
- [NVD - CVE-2026-44747](https://nvd.nist.gov/vuln/detail/CVE-2026-44747)
- [SAP Security Update July 2026 – Patch for Critical SAP NetWeaver Flaw that Enables Memory Corruption](https://www.cryptika.com/sap-security-update-july-2026-patch-for-critical-sap-netweaver-flaw-that-enables-memory-corruption/)
- [Critical Memory Corruption Flaw Disclosed in SAP NetWeaver AS ABAP](https://www.mallory.ai/stories/019f5e60-31d1-7c4f-84d1-f77e82315fde)
- [SAP® Security News - 07/2026](https://www.entplexit.com/post/sap-security-news-07-2026)
- [Default Users - SAP Commerce Cloud Help Portal](https://help.sap.com/docs/SAP_COMMERCE/9433604f14ac4ed98908c6d4e7d8c1cc/d42c4e3fbde74b5eb2056fb1a1b115e8.html)
- [SAP Security Patch Day for June 2026 - Onapsis](https://onapsis.com/blog/sap-security-patch-day-june-2026/)
- [SAP Patch Tuesday June 2026: Critical Vulnerabilities - Pathlock](https://pathlock.com/blog/security-alerts/sap-patch-tuesday-june-2026/)
- [SAP Security Notes, June 2026 - Layer Seven Security](https://www.layersevensecurity.com/sap-security-notes-june-2026/)
- [CVE-2025-31324 SAP Zero-Day Vulnerability | Full Threat Brief - Onapsis](https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/)
- [U.S. CISA adds SAP NetWeaver flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/177218/hacking/u-s-cisa-adds-sap-netweaver-flaw-to-its-known-exploited-vulnerabilities-catalog.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1302