SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw (CVE-2026-44747), Plus Critical Approuter and Commerce Cloud Bugs

SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw (TL-2026-1329), also tracked as SAP July 2026 Security Patch Day, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-07-14. It has no confirmed attribution, affects SAP NetWeaver Application Server ABAP, references 3 CVEs (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761), maps to 17 MITRE ATT&CK techniques (T1046, T1068, T1071), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1329

Threat ID
TL-2026-1329
Also known as
SAP July 2026 Security Patch Day
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, manufacturing, retail, energy, health, logistics, technology
Target regions
Global
Detection rules
9
Indicators of compromise
20

SAP's July 2026 Security Patch Day fixed CVE-2026-44747 (CVSS 9.9), a CWE-787 out-of-bounds write in NetWeaver Application Server ABAP that lets an authenticated, low-privileged attacker corrupt memory and access, modify, or take down enterprise ERP data. The same batch patched CVE-2026-27690 (CVSS 9.1), an unauthenticated HTTP request-smuggling flaw in SAP Approuter, and CVE-2026-44761 (CVSS 9.1), unauthenticated exploitation of publicly documented sample OAuth 2.0 credentials in SAP Commerce Cloud. No active exploitation or public PoC has been observed for any of the three.

How SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw works

On its July 2026 Security Patch Day, SAP released 16 new security notes (plus one GitHub advisory) addressing 6 critical, 6 high, 7 medium, and 1 low-severity issues across the NetWeaver, Approuter, and Commerce Cloud product lines. The headline flaw, CVE-2026-44747, is a CWE-787 out-of-bounds write in the SAP NetWeaver Application Server ABAP runtime — the kernel-level execution environment underpinning most classic SAP ERP, S/4HANA, and custom ABAP application deployments. SAP describes the root cause as 'logical errors in memory management': an authenticated user (PR:L, low privileges required, no user interaction) can trigger heap/stack memory corruption through crafted requests processed by the ABAP kernel. Because the scope is Changed (S:C) in the CVSS vector, corruption in the kernel process can affect resources beyond the vulnerable component's own security authority — a hallmark of kernel-level memory-safety bugs that can pivot from a low-privilege session into broader confidentiality (C:H), integrity (I:H), and availability (A:H) impact, including unauthorized data access, data tampering, or a full application-server outage. The vulnerability affects a wide span of ABAP kernel release trains: KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16 through 9.20 — spanning nearly two decades of still-supported SAP kernel branches, reflecting how long-lived and rarely-patched production ABAP stacks tend to be. SAP's advisory (Security Note 3747367) recommends installing the patched ABAP Kernel version as the permanent fix; as an interim compensating control, Onapsis notes that administrators can disable ICF (Internet Communication Framework) service nodes carrying a specific property via transaction SICF, though this breaks SAP GUI for HTML (WebGUI) transaction launching and is explicitly a partial mitigation, not a substitute for patching. In the same disclosure batch, CVE-2026-27690 affects SAP Approuter, the Node.js-based reverse-proxy/routing middleware fronting SAP Business Technology Platform (BTP) applications in non-Cloud Foundry deployments. An unauthenticated attacker can send a specially crafted HTTP request that triggers request-response desynchronization (HTTP request/response smuggling), allowing exposure of other users' HTTP responses and enabling denial-of-service conditions against the fronted application. CVE-2026-44761 affects SAP Commerce Cloud (formerly Hybris) and stems from a sample OAuth 2.0 client configuration, distributed with publicly documented credentials in SAP Help Portal sample/tutorial material, that was left active in some production deployments. An unauthenticated attacker who obtains these well-known sample credentials can request a valid OAuth access token and invoke Commerce Cloud APIs to read and modify commerce data — customer records, catalogs, pricing, or orders — without ever needing to compromise a real account. Deployments that removed the sample client or rotated its credentials to unique values are not affected. As of disclosure, no vendor, CISA, or open-source reporting indicates in-the-wild exploitation of CVE-2026-44747, CVE-2026-27690, or CVE-2026-44761, and none appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given SAP's centrality to finance, supply-chain, HR, and manufacturing operations across nearly every large enterprise and government agency worldwide, and the historical pattern of SAP vulnerabilities being weaponized within weeks of patch disclosure (as seen with prior RECON, ICMAD, and NetWeaver deserialization flaws), rapid patch application and interim ICF hardening are strongly advised even absent confirmed exploitation.

MITRE ATT&CK techniques used in TL-2026-1329

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Execution

T1203 Exploitation for Client Execution

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1489 Service Stop; T1499 Endpoint Denial of Service; T1565 Data Manipulation

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Resource Development

T1588 Obtain Capabilities

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

  • SAP — NetWeaver Application Server ABAP
    Vulnerable versions: KRNL64NUC 7.22; KRNL64NUC 7.22EXT; KRNL64UC 7.22; KRNL64UC 7.53; KRNL64UC 7.54; KRNL64UC 7.77; KRNL64UC 7.89; KRNL64UC 7.93; KRNL64UC 9.16; KRNL64UC 9.17
    Fixed in: Patched ABAP Kernel version per SAP Security Note 3747367
  • SAP — SAP Approuter
    Vulnerable versions: Non-Cloud Foundry deployments prior to July 2026 patch
    Fixed in: SAP Approuter release fixed in July 2026 Security Patch Day
  • SAP — SAP Commerce Cloud
    Vulnerable versions: Deployments retaining the documented sample OAuth 2.0 client and default credentials
    Fixed in: Configurations with sample client removed or credentials rotated to unique values

Remediation for SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

Patches

  • SAP Security Note 3747367 — patched ABAP Kernel versions for CVE-2026-44747
  • SAP July 2026 Patch Day fix for SAP Approuter — CVE-2026-27690
  • SAP July 2026 Patch Day fix / configuration guidance for SAP Commerce Cloud sample OAuth client — CVE-2026-44761

Immediate actions

  • Apply SAP Security Note 3747367 to install the patched ABAP Kernel version addressing CVE-2026-44747
  • As an interim measure only, disable ICF nodes carrying the affected property via transaction SICF (note this breaks SAP GUI for HTML transaction launching)
  • Patch SAP Approuter to the fixed release to remediate CVE-2026-27690 in non-Cloud Foundry deployments
  • Audit SAP Commerce Cloud production environments for the sample OAuth 2.0 client documented on SAP Help Portal and rotate or remove its credentials for CVE-2026-44761
  • Review SAP Patch Day July 2026 bulletin for the full set of 16 security notes and apply all critical/high items

Workarounds

  • Disable ICF nodes with the affected property in transaction SICF as a temporary compensating control for CVE-2026-44747 (breaks SAP GUI for HTML)
  • Remove or rotate the sample OAuth 2.0 client credentials in SAP Commerce Cloud to neutralize CVE-2026-44761 without a full patch cycle

Longer-term hardening

  • Establish a monthly SAP Security Patch Day review and rapid-deployment process given SAP's history of fast post-disclosure weaponization
  • Deploy an SAP-aware WAF/reverse-proxy layer to detect anomalous ABAP kernel request patterns and HTTP smuggling attempts
  • Implement SAP-specific SIEM monitoring (e.g., via Onapsis, SecurityBridge, or native SAP Enterprise Threat Detection) for ICF and kernel-level anomalies
  • Maintain an inventory of all sample/tutorial credentials and configurations shipped with SAP products; remove or rotate before go-live
  • Segment SAP application servers from general corporate networks and restrict authenticated access to the minimum required role set

CVEs associated with SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

CVE-2026-44747, CVE-2026-27690, CVE-2026-44761

Weaknesses (CWE) in SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

CWE-787

Timeline of SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

  • No evidence of active in-the-wild exploitation or public proof-of-concept is confirmed for CVE-2026-44747, CVE-2026-27690, or CVE-2026-44761; none appear in the CISA KEV catalog.
  • The Hacker News, BleepingComputer, SecurityWeek, CyberPress, GBHackers, and other outlets report on the SAP July 2026 Patch Day disclosures.
  • Onapsis publishes interim mitigation guidance recommending disabling affected ICF nodes via transaction SICF pending kernel patch deployment.
  • SAP releases patched ABAP Kernel versions under Security Note 3747367, along with fixed SAP Approuter and Commerce Cloud configuration guidance.
  • CVE-2026-44761 is published, documenting a CVSS 9.1 unauthenticated exploitation path via publicly documented sample OAuth 2.0 credentials in SAP Commerce Cloud.
  • CVE-2026-27690 is published, documenting a CVSS 9.1 unauthenticated HTTP request/response smuggling flaw in SAP Approuter for non-Cloud Foundry deployments.
  • CVE-2026-44747 is published, documenting a CVSS 9.9 out-of-bounds write (CWE-787) in SAP NetWeaver Application Server ABAP affecting multiple ABAP kernel release trains.
  • SAP publishes its July 2026 Security Patch Day bulletin, releasing 16 new security notes and one GitHub advisory covering NetWeaver, Approuter, and Commerce Cloud products.

Sources cited for SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

Threats related to SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw

Detection coverage for TL-2026-1329

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1329 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats