SAP July 2026 Patch Day: Critical Memory Corruption in NetWeaver ABAP (CVE-2026-44747, CVSS 9.9) Among 16 Security Notes

SAP July 2026 Patch Day (TL-2026-1303), also tracked as SAP Security Patch Day July 2026, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-07-14. It has no confirmed attribution, affects SAP SAP NetWeaver Application Server ABAP (kernel), references 14 CVEs (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761), maps to 18 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-1303

Threat ID
TL-2026-1303
Also known as
SAP Security Patch Day July 2026, SAP Patch Tuesday July 2026
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, manufacturing, retail, energy, health, technology
Target regions
Global, North America, Europe, Asia Pacific
Detection rules
9
Indicators of compromise
25

SAP's July 2026 Security Patch Day released 16 new security notes, one GitHub security advisory, and three updates to prior notes, headlined by a critical memory corruption vulnerability in NetWeaver Application Server ABAP (CVE-2026-44747, CVSS 9.9, CWE-787) that is network-exploitable with low attack complexity, low privileges, and no user interaction. Three other critical (9.0+) flaws were also patched: HTTP request smuggling in SAP Approuter (CVE-2026-27690, 9.1), insecure sample credentials in Commerce Cloud (CVE-2026-44761, 9.1), and directory traversal in NetWeaver AS Java Web Container (CVE-2026-40128, 9.0).

How SAP July 2026 Patch Day works

SAP's monthly Security Patch Day for July 2026 (released 2026-07-14) is one of the year's heaviest, bundling 16 new security notes plus a GitHub advisory and three revisions to previously issued notes. The headline issue, CVE-2026-44747 (SAP Note 3747367, CVSS 3.1 base score 9.9, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-787 Out-of-bounds Write), is a memory corruption flaw in the SAP NetWeaver Application Server ABAP kernel. Because the flaw sits in the ABAP kernel binary itself rather than an application layer, it spans an unusually wide version matrix: KRNL64NUC/KRNL64UC 7.22 and 7.22EXT, and kernel releases 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20 -- covering roughly two decades of still-supported SAP Basis deployments. An attacker who can reach the ABAP kernel over the network with low-privileged credentials can corrupt memory to affect confidentiality, integrity, and availability, with the CVSS Scope:Changed metric indicating the corruption can affect resources beyond the vulnerable component's own security scope (e.g., escalate out of the kernel dispatcher into other work processes).

Three further critical vulnerabilities round out the top tier. CVE-2026-27690 (SAP Note 3720138, CVSS 9.1) is an HTTP request smuggling flaw in SAP Approuter versions prior to 20.10.0: a specially crafted HTTP request can desynchronize how the Approuter reverse proxy and the back-end application interpret request boundaries, letting an unauthenticated attacker bypass front-end security controls, poison another user's response, or trigger denial of service. CVE-2026-44761 (SAP Note 3753495, CVSS 9.1) affects SAP Commerce Cloud releases HY_COM 2205 and COM_CLOUD 2211/2211-JDK21, where insecure, apparently hardcoded sample/default credentials shipped with the product (CWE-798-class weakness) can grant an attacker unauthorized access to affected environments. CVE-2026-40128 (SAP Note 3727078, CVSS 9.0, originally published 2026-06-09 and re-surfaced in the consolidated July bulletin) is a directory traversal in the NetWeaver AS Java Web Container: an unauthenticated attacker can craft a malicious HTTP logon request that manipulates file-inclusion parameters to escape the intended application context, causing the server to process an unintended local file, exposing or corrupting sensitive data, or degrading availability.

Beyond the four >=9.0 flaws, the same patch day addresses a broad tail of high-severity issues (CVSS 7.6-8.8): three Apache Camel vulnerabilities bundled into SAP Integration Suite (CVE-2026-40860, CVE-2026-40453, CVE-2026-33454, 8.8), a DLL hijacking flaw in SAProuter for Windows (CVE-2026-0487, 8.4, CWE-427 Uncontrolled Search Path Element), cross-site scripting in the NetWeaver Configuration Wizard (CVE-2026-44752, 8.2), an open redirect in SAP Approuter (CVE-2026-44745, 8.1), three bundled Apache Tomcat vulnerabilities in Commerce Cloud (CVE-2026-43512, CVE-2026-41293, CVE-2026-43515, 8.1), and a remote code execution flaw in the Change and Transport System (CTS) Attach Tool (CVE-2026-58233, 7.6). Medium-severity notes cover SQL injection, additional XSS, missing authorization checks, and path traversal issues (4.1-6.1), and low-priority notes cover information disclosure and a residual Log4j-related advisory (3.3-3.7).

As of publication, no source confirms in-the-wild exploitation of any July 2026 SAP CVE, and none of the four headline CVEs currently appear in the CISA Known Exploited Vulnerabilities catalog. However, SAP NetWeaver has a well-established history of rapid n-day weaponization after Patch Tuesday disclosures (the KEV catalog already lists several older SAP NetWeaver Visual Composer, Invoker Servlet, and Universal Worklist flaws as confirmed exploited), and the prior month's SAP June 2026 Patch Day disclosed two similarly critical NetWeaver AS ABAP flaws -- CVE-2026-44748 (XML Signature Wrapping in SAML authentication, CVSS 9.9) and CVE-2026-27671 (unauthenticated RFC-protocol memory corruption, CVSS 9.8) -- establishing a recurring pattern of critical, network-reachable AS ABAP vulnerabilities across consecutive patch cycles. Given the internet-facing nature of many SAP NetWeaver deployments (Fiori launchpads, Web Dispatchers, Approuter reverse proxies) and the low complexity/no-user-interaction profile of CVE-2026-44747, defenders should treat rapid patch adoption and network segmentation as time-critical.

MITRE ATT&CK techniques used in TL-2026-1303

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Persistence

T1078 Valid Accounts

Discovery

T1083 File and Directory Discovery; T1518 Software Discovery

Command and Control

T1090 Proxy

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth; T1574 Hijack Execution Flow

Impact

T1499 Endpoint Denial of Service

Credential Access

T1552 Unsecured Credentials

stealth

T1574 Hijack Execution Flow

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in SAP July 2026 Patch Day

  • SAP — SAP NetWeaver Application Server ABAP (kernel)
    Vulnerable versions: KRNL64NUC 7.22; KRNL64UC 7.22; 7.22EXT; 7.53; 7.54; 7.77; 7.89; 7.93; 9.16; 9.18
    Fixed in: Patched kernel per SAP Note 3747367
  • SAP — SAP Approuter
    Vulnerable versions: < 20.10.0
    Fixed in: 20.10.0
  • SAP — SAP Commerce Cloud
    Vulnerable versions: HY_COM 2205; COM_CLOUD 2211; COM_CLOUD 2211-JDK21
    Fixed in: Per SAP Note 3753495
  • SAP — SAP NetWeaver Application Server Java (Web Container)
    Vulnerable versions: Affected releases per SAP Note 3727078
    Fixed in: Per SAP Note 3727078
  • SAP — SAProuter (Windows)
    Vulnerable versions: Affected releases per associated SAP Note
    Fixed in: Per associated SAP Note
  • SAP — SAP Integration Suite (Apache Camel components)
    Vulnerable versions: Bundled Apache Camel versions affected by CVE-2026-40860, CVE-2026-40453, CVE-2026-33454
    Fixed in: Updated bundled Apache Camel per SAP Note

Remediation for SAP July 2026 Patch Day

Patches

  • SAP Note 3747367 (CVE-2026-44747)
  • SAP Note 3720138 (CVE-2026-27690)
  • SAP Note 3753495 (CVE-2026-44761)
  • SAP Note 3727078 (CVE-2026-40128)

Immediate actions

  • Apply SAP Note 3747367 to remediate CVE-2026-44747 (memory corruption, NetWeaver AS ABAP) on all affected kernel releases as top priority
  • Apply SAP Note 3720138 to update SAP Approuter to 20.10.0 or later, fixing CVE-2026-27690
  • Apply SAP Note 3753495 to remove/rotate insecure sample credentials in SAP Commerce Cloud (CVE-2026-44761)
  • Apply SAP Note 3727078 to remediate the AS Java Web Container directory traversal (CVE-2026-40128)
  • Restrict network access to SAP application servers, message servers, and gateway ports from untrusted networks pending patch rollout

Workarounds

  • Where immediate patching is not possible, restrict network-level access to the ABAP kernel dispatcher and AS Java Web Container to trusted management networks only
  • Disable or rotate any known sample/default credentials in Commerce Cloud immediately, independent of patch timing
  • Front reverse-proxy/Approuter deployments with strict HTTP normalization to reduce request-smuggling exposure until upgraded to 20.10.0+

Longer-term hardening

  • Establish a recurring SAP Security Patch Day review and expedited test/apply cadence given the frequency of critical (9.0+) AS ABAP/AS Java disclosures month over month
  • Deploy SAP-aware monitoring (SAP Enterprise Threat Detection or equivalent SIEM content) for anomalous RFC, HTTP logon, and kernel dispatcher activity
  • Inventory and decommission legacy sample/default accounts across SAP Commerce Cloud and other product lines
  • Segment internet-facing SAP components (Approuter, Web Dispatcher, Fiori launchpad) from back-end ABAP/Java application servers

CVEs associated with SAP July 2026 Patch Day

Weaknesses (CWE) in SAP July 2026 Patch Day

CWE-787, CWE-444, CWE-798, CWE-1392, CWE-22, CWE-427, CWE-79, CWE-502

Timeline of SAP July 2026 Patch Day

  • CVE-2026-40128 (SAP NetWeaver AS Java Web Container directory traversal, CVSS 9.0) is published in NVD, tied to SAP Note 3727078, ahead of being carried forward into the July consolidated Patch Day summary.
  • SAP's June 2026 Security Patch Day discloses two additional critical NetWeaver AS ABAP flaws -- CVE-2026-44748 (CVSS 9.9, XML Signature Wrapping in SAML authentication) and CVE-2026-27671 (CVSS 9.8, unauthenticated RFC-protocol memory corruption) -- establishing a recurring monthly pattern of critical, network-reachable AS ABAP vulnerabilities.
  • CVE-2026-27690 (SAP Approuter Node.js HTTP request smuggling), CVE-2026-44761 (SAP Commerce Cloud default OAuth2 client credentials, CWE-1392), and CVE-2026-58233 (CTS Attach Tool insecure deserialization RCE, CWE-502) are all published in NVD the same day as CVE-2026-44747, one day ahead of the consolidated July Patch Day bulletin.
  • CVE-2026-44747 (SAP NetWeaver AS ABAP memory corruption, CVSS 9.9, CWE-787) is published in NVD, tied to SAP Note 3747367.
  • TL-Intel Harness RSS hunt phase ingests the Cyber Security News advisory and opens TL-2026-1303 for tracking, flagged CRITICAL (CVSS 9.9) with no confirmed in-the-wild exploitation as of ingestion.
  • The Cyber Security Agency of Singapore (CSA) issues Alert AL-2026-075 covering the critical SAP NetWeaver and Commerce Cloud vulnerabilities from the July patch cycle.
  • Cyber Security News publishes the first public secondary-source summary of the July 2026 SAP Patch Day, cataloguing the headline critical CVEs and the broader high/medium/low severity notes.
  • SAP releases its July 2026 Security Patch Day: 16 new security notes, 1 GitHub security advisory, and 3 updates to previously released notes, headlined by SAP Note 3747367 (CVE-2026-44747) plus three other critical (9.0+) fixes for Approuter, Commerce Cloud, and NetWeaver AS Java.
  • Cryptika publishes a technical analysis of the July 2026 SAP Patch Day focused on CVE-2026-44747, detailing the NetWeaver AS ABAP memory corruption mechanics and remediation via SAP Note 3747367.

Sources cited for SAP July 2026 Patch Day

Threats related to SAP July 2026 Patch Day

Detection coverage for TL-2026-1303

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1303 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats