CVE-2026-44747: Critical Memory Corruption in SAP NetWeaver Application Server ABAP (CVSS 9.9)

CVE-2026-44747 (TL-2026-1438), also tracked as SAP Security Note 3747367, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-07-17. It has no confirmed attribution, affects SAP SAP NetWeaver Application Server ABAP (KRNL64NUC), references 4 CVEs (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761), maps to 18 MITRE ATT&CK techniques (T1046, T1068, T1070), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1438

Threat ID
TL-2026-1438
Also known as
SAP Security Note 3747367, SAP July 2026 Patch Day NetWeaver ABAP Flaw
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-17
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, manufacturing, finance, energy, retail, critical-infrastructure, supply-chain
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in CVE-2026-44747

Malware and tooling: SAP transaction SICF

SAP's July 2026 Security Patch Day fixed CVE-2026-44747, a CVSS 9.9 out-of-bounds write (CWE-787) in the SAP NetWeaver Application Server ABAP kernel, where an authenticated attacker with only low privileges could trigger memory corruption via logical errors in memory management, leading to unauthorized data access, data modification, or system unavailability. The patch (SAP Security Note 3747367) was released July 14, 2026 with research support from Onapsis Research Labs; no public PoC or active exploitation was reported at disclosure.

How CVE-2026-44747 works

CVE-2026-44747 is a critical out-of-bounds write vulnerability (CWE-787) in the kernel of SAP NetWeaver Application Server ABAP (AS ABAP), the core runtime, application server, and development platform underlying the majority of SAP's on-premise ERP, S/4HANA, and custom ABAP-based enterprise deployments. The flaw is rooted in logical errors within the kernel's memory-management routines: an authenticated attacker holding only low privileges can send crafted requests or invoke specific kernel-level functionality that causes the kernel to write data outside the bounds of an allocated buffer or object. Because the corrupted memory lives inside the privileged application-server process space, the resulting corruption can be leveraged to alter program execution flow, read or modify data the attacker should not have access to, or crash the kernel process outright, producing a denial of service for the affected SAP instance.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable vulnerability with low attack complexity, requiring only low privileges and no user interaction, with a scope change (S:C) indicating the impact extends beyond the vulnerable component's own security authority into other components of the SAP landscape — consistent with kernel-level memory corruption in a multi-tenant enterprise application server. Full compromise yields high impact to confidentiality, integrity, and availability simultaneously, which is why the score sits at the top of the critical band (9.9).

The vulnerability spans an unusually broad kernel version matrix — KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22/7.22EXT/7.53, and KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20 — meaning it affects both legacy Non-Unicode kernel branches still running in older NetWeaver landscapes and the current 9.x kernel lines used by modern S/4HANA and NetWeaver AS ABAP installations, making the exposure relevant to nearly every AS ABAP customer regardless of upgrade cadence.

SAP's primary remediation is deployment of a corrected ABAP kernel patch level per Security Note 3747367. Onapsis, credited with contributing to discovery/response, documented a temporary compensating control: disabling specific ICF (Internet Communication Framework) nodes via transaction SICF that expose the vulnerable functionality. This workaround is explicitly a stopgap — SAP and Onapsis both note it interrupts SAP GUI for HTML (WebGUI) workflows for affected users and is not viable for all customer landscapes, so kernel patching remains the recommended fix.

The fix shipped as part of a broader July 2026 SAP Patch Day releasing 16 new security notes plus one GitHub security advisory and three updates to prior notes, including two other critical (CVSS ≥9.0) issues disclosed the same day: CVE-2026-27690 (CVSS 9.1, unauthenticated HTTP request/response smuggling in the Node.js-based SAP Approuter used by non-Cloud-Foundry BTP applications, enabling response hijacking and DoS) and CVE-2026-44761 (CVSS 9.1, a hard-coded/default sample OAuth 2.0 client credential shipped in SAP Commerce Cloud documentation, letting an unauthenticated attacker mint valid access tokens and read/modify Commerce Cloud data via its APIs). A fourth high-severity SAP AS Java Web Container directory-traversal flaw (CVE-2026-40128, CVSS 9.0) allowing unauthorized file access/modification was reported alongside these in patch-day coverage.

No evidence of in-the-wild exploitation or a public proof-of-concept exists for CVE-2026-44747 as of disclosure, and it has not (yet) been added to the CISA Known Exploited Vulnerabilities catalog. However, SAP vulnerabilities are a persistent, high-value target for ransomware affiliates and espionage actors: CISA has added 14 separate SAP flaws to KEV since November 2021, including at least two subsequently weaponized by ransomware operators, underscoring that the historical time-to-exploitation for critical SAP kernel/NetWeaver bugs is short once technical detail becomes public. Given the low privilege bar (PR:L), the scope-changing kernel-level impact, and SAP AS ABAP's presence at the core of ERP/finance/HR/supply-chain business processes across government, manufacturing, financial services, energy, and critical-infrastructure sectors, this vulnerability should be treated as a high-priority emergency patch even absent confirmed in-the-wild activity.

MITRE ATT&CK techniques used in TL-2026-1438

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal; T1211 Exploitation for Stealth

Collection

T1074 Data Staged; T1213 Data from Information Repositories

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

stealth

T1078 Valid Accounts

Execution

T1203 Exploitation for Client Execution

Impact

T1489 Service Stop; T1499 Endpoint Denial of Service; T1565 Data Manipulation

Persistence

T1505 Server Software Component

Credential Access

T1552 Unsecured Credentials

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in CVE-2026-44747

  • SAP — SAP NetWeaver Application Server ABAP (KRNL64NUC)
    Vulnerable versions: 7.22; 7.22EXT
    Fixed in: Patched ABAP kernel per SAP Note 3747367
  • SAP — SAP NetWeaver Application Server ABAP (KRNL64UC)
    Vulnerable versions: 7.22; 7.22EXT; 7.53
    Fixed in: Patched ABAP kernel per SAP Note 3747367
  • SAP — SAP NetWeaver Application Server ABAP (KERNEL)
    Vulnerable versions: 7.22; 7.53; 7.54; 7.77; 7.89; 7.93; 9.16; 9.18; 9.19; 9.20
    Fixed in: Patched ABAP kernel per SAP Note 3747367

Remediation for CVE-2026-44747

Patches

  • SAP Security Note 3747367 (CVE-2026-44747) — corrected ABAP kernel

Immediate actions

  • Apply SAP Security Note 3747367 to bring the AS ABAP kernel to the corrected patch level on all affected KRNL64NUC/KRNL64UC/KERNEL builds
  • Inventory all SAP NetWeaver AS ABAP and S/4HANA landscapes for exposure to kernel versions 7.22 through 9.20
  • Restrict network access to SAP application server ports/ICF services from untrusted networks pending patch deployment
  • Where kernel patching cannot be scheduled immediately, apply the Onapsis-documented temporary workaround of disabling the affected ICF nodes via transaction SICF, understanding this breaks SAP GUI for HTML workflows

Workarounds

  • Disable specific ICF nodes via transaction SICF (interrupts SAP GUI for HTML; not viable for all customers)

Longer-term hardening

  • Establish a standing SAP Patch Day (2nd Tuesday monthly) rapid-triage and emergency-patch process given SAP's documented history of 14 flaws added to CISA KEV since 2021
  • Deploy SAP-aware monitoring/logging (e.g., Onapsis Platform, SAP Enterprise Threat Detection) to flag anomalous ICF requests and abnormal kernel-level activity
  • Segment SAP application servers from general corporate networks and limit authenticated low-privilege account exposure to internet-facing SAP endpoints
  • Periodically audit SAP Commerce Cloud and BTP Approuter deployments for default/sample credentials and outdated middleware (see CVE-2026-44761, CVE-2026-27690)

CVEs associated with CVE-2026-44747

CVE-2026-44747, CVE-2026-27690, CVE-2026-44761, CVE-2026-40128

Weaknesses (CWE) in CVE-2026-44747

CWE-787

Timeline of CVE-2026-44747

  • SAP's June 2026 Patch Day addresses CVE-2026-44748, a SAML authentication vulnerability in NetWeaver, setting the stage for continued NetWeaver-focused hardening the following month.
  • CVE-2026-44747 formally published in NVD with CVSS 3.1 base score 9.9 and CWE-787 classification.
  • Security media (SOCRadar, The Hacker News, BleepingComputer, SecurityOnline, CyberSecurityNews, CISO Platform) publish coverage of the July 2026 SAP Patch Day, highlighting CVE-2026-44747 as the headline critical flaw.
  • Onapsis Research Labs, credited with contributing to the vulnerability's discovery/remediation, publishes guidance on a temporary ICF-node-disabling workaround via transaction SICF for organizations unable to immediately patch the kernel.
  • CISA's SSVC (Stakeholder-Specific Vulnerability Categorization) record for CVE-2026-44747 is added, reflecting federal tracking of the disclosure despite no confirmed active exploitation.
  • SAP's July 2026 Security Patch Day (second Tuesday) releases 16 new security notes plus one GitHub security advisory and three updates to prior notes, including SAP Security Note 3747367 fixing CVE-2026-44747 in the AS ABAP kernel, alongside CVE-2026-27690 (SAP Approuter smuggling) and CVE-2026-44761 (SAP Commerce Cloud default credentials).
  • NVD record for CVE-2026-44747 last modified, finalizing CPE affected-version ranges across KRNL64NUC, KRNL64UC, and KERNEL branches 7.22 through 9.20.
  • Threadlinqs Intelligence Platform ingests and researches CVE-2026-44747 for the TL-2026-1438 threat record.

Sources cited for CVE-2026-44747

Threats related to CVE-2026-44747

Detection coverage for TL-2026-1438

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1438 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats