# SAP July 2026 Patch Day: Critical Memory Corruption in NetWeaver ABAP (CVE-2026-44747, CVSS 9.9) Among 16 Security Notes

> SAP's July 2026 Security Patch Day released 16 new security notes, one GitHub security advisory, and three updates to prior notes, headlined by a critical memory corruption vulnerability in NetWeaver Application Server ABAP (CVE-2026-44747, CVSS 9.9, CWE-787) that is network-exploitable with low attack complexity, low privileges, and no user interaction. Three other critical (9.0+) flaws were also patched: HTTP request smuggling in SAP Approuter (CVE-2026-27690, 9.1), insecure sample credentials in Commerce Cloud (CVE-2026-44761, 9.1), and directory traversal in NetWeaver AS Java Web Container (CVE-2026-40128, 9.0).

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1303
- **ID:** TL-2026-1303
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-44747, CVE-2026-27690, CVE-2026-44761, CVE-2026-40128, CVE-2026-58233, CVE-2026-0487, CVE-2026-44752, CVE-2026-44745, CVE-2026-40860, CVE-2026-40453, CVE-2026-33454, CVE-2026-43512, CVE-2026-41293, CVE-2026-43515

## Description

SAP's monthly Security Patch Day for July 2026 (released 2026-07-14) is one of the year's heaviest, bundling 16 new security notes plus a GitHub advisory and three revisions to previously issued notes. The headline issue, CVE-2026-44747 (SAP Note 3747367, CVSS 3.1 base score 9.9, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-787 Out-of-bounds Write), is a memory corruption flaw in the SAP NetWeaver Application Server ABAP kernel. Because the flaw sits in the ABAP kernel binary itself rather than an application layer, it spans an unusually wide version matrix: KRNL64NUC/KRNL64UC 7.22 and 7.22EXT, and kernel releases 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20 -- covering roughly two decades of still-supported SAP Basis deployments. An attacker who can reach the ABAP kernel over the network with low-privileged credentials can corrupt memory to affect confidentiality, integrity, and availability, with the CVSS Scope:Changed metric indicating the corruption can affect resources beyond the vulnerable component's own security scope (e.g., escalate out of the kernel dispatcher into other work processes).

Three further critical vulnerabilities round out the top tier. CVE-2026-27690 (SAP Note 3720138, CVSS 9.1) is an HTTP request smuggling flaw in SAP Approuter versions prior to 20.10.0: a specially crafted HTTP request can desynchronize how the Approuter reverse proxy and the back-end application interpret request boundaries, letting an unauthenticated attacker bypass front-end security controls, poison another user's response, or trigger denial of service. CVE-2026-44761 (SAP Note 3753495, CVSS 9.1) affects SAP Commerce Cloud releases HY_COM 2205 and COM_CLOUD 2211/2211-JDK21, where insecure, apparently hardcoded sample/default credentials shipped with the product (CWE-798-class weakness) can grant an attacker unauthorized access to affected environments. CVE-2026-40128 (SAP Note 3727078, CVSS 9.0, originally published 2026-06-09 and re-surfaced in the consolidated July bulletin) is a directory traversal in the NetWeaver AS Java Web Container: an unauthenticated attacker can craft a malicious HTTP logon request that manipulates file-inclusion parameters to escape the intended application context, causing the server to process an unintended local file, exposing or corrupting sensitive data, or degrading availability.

Beyond the four >=9.0 flaws, the same patch day addresses a broad tail of high-severity issues (CVSS 7.6-8.8): three Apache Camel vulnerabilities bundled into SAP Integration Suite (CVE-2026-40860, CVE-2026-40453, CVE-2026-33454, 8.8), a DLL hijacking flaw in SAProuter for Windows (CVE-2026-0487, 8.4, CWE-427 Uncontrolled Search Path Element), cross-site scripting in the NetWeaver Configuration Wizard (CVE-2026-44752, 8.2), an open redirect in SAP Approuter (CVE-2026-44745, 8.1), three bundled Apache Tomcat vulnerabilities in Commerce Cloud (CVE-2026-43512, CVE-2026-41293, CVE-2026-43515, 8.1), and a remote code execution flaw in the Change and Transport System (CTS) Attach Tool (CVE-2026-58233, 7.6). Medium-severity notes cover SQL injection, additional XSS, missing authorization checks, and path traversal issues (4.1-6.1), and low-priority notes cover information disclosure and a residual Log4j-related advisory (3.3-3.7).

As of publication, no source confirms in-the-wild exploitation of any July 2026 SAP CVE, and none of the four headline CVEs currently appear in the CISA Known Exploited Vulnerabilities catalog. However, SAP NetWeaver has a well-established history of rapid n-day weaponization after Patch Tuesday disclosures (the KEV catalog already lists several older SAP NetWeaver Visual Composer, Invoker Servlet, and Universal Worklist flaws as confirmed exploited), and the prior month's SAP June 2026 Patch Day disclosed two similarly critical NetWeaver AS ABAP flaws -- CVE-2026-44748 (XML Signature Wrapping in SAML authentication, CVSS 9.9) and CVE-2026-27671 (unauthenticated RFC-protocol memory corruption, CVSS 9.8) -- establishing a recurring pattern of critical, network-reachable AS ABAP vulnerabilities across consecutive patch cycles. Given the internet-facing nature of many SAP NetWeaver deployments (Fiori launchpads, Web Dispatchers, Approuter reverse proxies) and the low complexity/no-user-interaction profile of CVE-2026-44747, defenders should treat rapid patch adoption and network segmentation as time-critical.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1574 Hijack Execution Flow
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1574 Hijack Execution Flow
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1499 Endpoint Denial of Service

## Sources

- [SAP Security Update July 2026 - SAP Security Patch Day](https://cybersecuritynews.com/sap-security-update-july-2026/)
- [NVD - CVE-2026-44747](https://nvd.nist.gov/vuln/detail/CVE-2026-44747)
- [SAP Security Update July 2026 - Patch for Critical SAP NetWeaver Flaw that Enables Memory Corruption](https://www.cryptika.com/sap-security-update-july-2026-patch-for-critical-sap-netweaver-flaw-that-enables-memory-corruption/)
- [SAP Security Patch Day - July 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html)
- [SAP fixes critical flaws in NetWeaver and Commerce Cloud](https://www.bleepingcomputer.com/news/security/sap-fixes-critical-flaws-in-netweaver-and-commerce-cloud/)
- [SAP Patches Critical NetWeaver, Commerce Vulnerabilities](https://www.securityweek.com/sap-patches-critical-netweaver-commerce-vulnerabilities/)
- [Critical Vulnerabilities in SAP NetWeaver and SAP Commerce Cloud](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-075/)
- [SAP NetWeaver AS ABAP Memory Corruption (3717897)](https://www.tenable.com/plugins/nessus/320859)
- [SAP NetWeaver AS Java Directory Traversal (3727078)](https://www.tenable.com/plugins/nessus/320857)
- [CVE-2026-40128 - Directory Traversal vulnerability in SAP NetWeaver Application Server Java](https://cvefeed.io/vuln/detail/CVE-2026-40128)
- [SAP Patch Tuesday June 2026: Critical Vulnerabilities](https://pathlock.com/blog/security-alerts/sap-patch-tuesday-june-2026/)
- [CVE-2026-40128: SAP NetWeaver Application Server Java (Web Container)](https://www.thehackerwire.com/cve-2026-40128-sap-netweaver-application-server-java-web-container-all/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1303