# SAP Patches CVSS 9.9 NetWeaver ABAP Out-of-Bounds Write Flaw (CVE-2026-44747), Plus Critical Approuter and Commerce Cloud Bugs

> SAP's July 2026 Security Patch Day fixed CVE-2026-44747 (CVSS 9.9), a CWE-787 out-of-bounds write in NetWeaver Application Server ABAP that lets an authenticated, low-privileged attacker corrupt memory and access, modify, or take down enterprise ERP data. The same batch patched CVE-2026-27690 (CVSS 9.1), an unauthenticated HTTP request-smuggling flaw in SAP Approuter, and CVE-2026-44761 (CVSS 9.1), unauthenticated exploitation of publicly documented sample OAuth 2.0 credentials in SAP Commerce Cloud. No active exploitation or public PoC has been observed for any of the three.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1329
- **ID:** TL-2026-1329
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-44747, CVE-2026-27690, CVE-2026-44761

## Description

On its July 2026 Security Patch Day, SAP released 16 new security notes (plus one GitHub advisory) addressing 6 critical, 6 high, 7 medium, and 1 low-severity issues across the NetWeaver, Approuter, and Commerce Cloud product lines. The headline flaw, CVE-2026-44747, is a CWE-787 out-of-bounds write in the SAP NetWeaver Application Server ABAP runtime — the kernel-level execution environment underpinning most classic SAP ERP, S/4HANA, and custom ABAP application deployments. SAP describes the root cause as 'logical errors in memory management': an authenticated user (PR:L, low privileges required, no user interaction) can trigger heap/stack memory corruption through crafted requests processed by the ABAP kernel. Because the scope is Changed (S:C) in the CVSS vector, corruption in the kernel process can affect resources beyond the vulnerable component's own security authority — a hallmark of kernel-level memory-safety bugs that can pivot from a low-privilege session into broader confidentiality (C:H), integrity (I:H), and availability (A:H) impact, including unauthorized data access, data tampering, or a full application-server outage. The vulnerability affects a wide span of ABAP kernel release trains: KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16 through 9.20 — spanning nearly two decades of still-supported SAP kernel branches, reflecting how long-lived and rarely-patched production ABAP stacks tend to be. SAP's advisory (Security Note 3747367) recommends installing the patched ABAP Kernel version as the permanent fix; as an interim compensating control, Onapsis notes that administrators can disable ICF (Internet Communication Framework) service nodes carrying a specific property via transaction SICF, though this breaks SAP GUI for HTML (WebGUI) transaction launching and is explicitly a partial mitigation, not a substitute for patching. In the same disclosure batch, CVE-2026-27690 affects SAP Approuter, the Node.js-based reverse-proxy/routing middleware fronting SAP Business Technology Platform (BTP) applications in non-Cloud Foundry deployments. An unauthenticated attacker can send a specially crafted HTTP request that triggers request-response desynchronization (HTTP request/response smuggling), allowing exposure of other users' HTTP responses and enabling denial-of-service conditions against the fronted application. CVE-2026-44761 affects SAP Commerce Cloud (formerly Hybris) and stems from a sample OAuth 2.0 client configuration, distributed with publicly documented credentials in SAP Help Portal sample/tutorial material, that was left active in some production deployments. An unauthenticated attacker who obtains these well-known sample credentials can request a valid OAuth access token and invoke Commerce Cloud APIs to read and modify commerce data — customer records, catalogs, pricing, or orders — without ever needing to compromise a real account. Deployments that removed the sample client or rotated its credentials to unique values are not affected. As of disclosure, no vendor, CISA, or open-source reporting indicates in-the-wild exploitation of CVE-2026-44747, CVE-2026-27690, or CVE-2026-44761, and none appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given SAP's centrality to finance, supply-chain, HR, and manufacturing operations across nearly every large enterprise and government agency worldwide, and the historical pattern of SAP vulnerabilities being weaponized within weeks of patch disclosure (as seen with prior RECON, ICMAD, and NetWeaver deserialization flaws), rapid patch application and interim ICF hardening are strongly advised even absent confirmed exploitation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1565 Data Manipulation
- T1499 Endpoint Denial of Service
- T1489 Service Stop
- T1588 Obtain Capabilities

## Sources

- [SAP Patches CVSS 9.9 NetWeaver ABAP Flaw](https://thehackernews.com/2026/07/sap-patches-cvss-99-netweaver-abap-flaw.html)
- [SAP warns of critical flaws in NetWeaver and Commerce Cloud](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/)
- [NVD - CVE-2026-44747](https://nvd.nist.gov/vuln/detail/CVE-2026-44747)
- [SAP Patches CVE-2026-44747 (CVSS 9.9): Critical Memory Corruption Flaw in NetWeaver AS ABAP](https://securityonline.info/sap-patch-day-july-2026/)
- [SAP NetWeaver Application Server ABAP allows an... · CVE-2026-44747](https://github.com/advisories/GHSA-wpx3-vvrc-3w8m)
- [SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud](https://www.securityweek.com/sap-patches-critical-vulnerabilities-in-netweaver-approuter-commerce-cloud/)
- [Critical Memory Corruption Flaw Disclosed in SAP NetWeaver AS ABAP](https://www.mallory.ai/stories/019f5e60-31d1-7c4f-84d1-f77e82315fde)
- [SAP Security Update July 2026 – Patch for Critical SAP NetWeaver Flaw that Enables Memory Corruption](https://www.cryptika.com/sap-security-update-july-2026-patch-for-critical-sap-netweaver-flaw-that-enables-memory-corruption/)
- [SAP July 2026 Patch Day Fixes Critical NetWeaver and Approuter Flaws](https://cyberpress.org/sap-july-2026-patch-day-fixes/)
- [SAP July 2026 Patch Day Fixes Critical NetWeaver, Approuter, and Commerce Cloud Vulnerabilities](https://gbhackers.com/sap-july-2026-patch-day-fixes-vulnerabilities/)
- [SAP Security Patch Day - July 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html)
- [SAP Security Note 3747367](https://me.sap.com/notes/3747367)
- [SAP Security Patch Day Portal](https://url.sap/sapsecuritypatchday)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1329