# CVE-2026-44747: Critical Memory Corruption in SAP NetWeaver Application Server ABAP (CVSS 9.9)

> SAP's July 2026 Security Patch Day fixed CVE-2026-44747, a CVSS 9.9 out-of-bounds write (CWE-787) in the SAP NetWeaver Application Server ABAP kernel, where an authenticated attacker with only low privileges could trigger memory corruption via logical errors in memory management, leading to unauthorized data access, data modification, or system unavailability. The patch (SAP Security Note 3747367) was released July 14, 2026 with research support from Onapsis Research Labs; no public PoC or active exploitation was reported at disclosure.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1438
- **ID:** TL-2026-1438
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-44747, CVE-2026-27690, CVE-2026-44761, CVE-2026-40128

## Description

CVE-2026-44747 is a critical out-of-bounds write vulnerability (CWE-787) in the kernel of SAP NetWeaver Application Server ABAP (AS ABAP), the core runtime, application server, and development platform underlying the majority of SAP's on-premise ERP, S/4HANA, and custom ABAP-based enterprise deployments. The flaw is rooted in logical errors within the kernel's memory-management routines: an authenticated attacker holding only low privileges can send crafted requests or invoke specific kernel-level functionality that causes the kernel to write data outside the bounds of an allocated buffer or object. Because the corrupted memory lives inside the privileged application-server process space, the resulting corruption can be leveraged to alter program execution flow, read or modify data the attacker should not have access to, or crash the kernel process outright, producing a denial of service for the affected SAP instance.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable vulnerability with low attack complexity, requiring only low privileges and no user interaction, with a scope change (S:C) indicating the impact extends beyond the vulnerable component's own security authority into other components of the SAP landscape — consistent with kernel-level memory corruption in a multi-tenant enterprise application server. Full compromise yields high impact to confidentiality, integrity, and availability simultaneously, which is why the score sits at the top of the critical band (9.9).

The vulnerability spans an unusually broad kernel version matrix — KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22/7.22EXT/7.53, and KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20 — meaning it affects both legacy Non-Unicode kernel branches still running in older NetWeaver landscapes and the current 9.x kernel lines used by modern S/4HANA and NetWeaver AS ABAP installations, making the exposure relevant to nearly every AS ABAP customer regardless of upgrade cadence.

SAP's primary remediation is deployment of a corrected ABAP kernel patch level per Security Note 3747367. Onapsis, credited with contributing to discovery/response, documented a temporary compensating control: disabling specific ICF (Internet Communication Framework) nodes via transaction SICF that expose the vulnerable functionality. This workaround is explicitly a stopgap — SAP and Onapsis both note it interrupts SAP GUI for HTML (WebGUI) workflows for affected users and is not viable for all customer landscapes, so kernel patching remains the recommended fix.

The fix shipped as part of a broader July 2026 SAP Patch Day releasing 16 new security notes plus one GitHub security advisory and three updates to prior notes, including two other critical (CVSS ≥9.0) issues disclosed the same day: CVE-2026-27690 (CVSS 9.1, unauthenticated HTTP request/response smuggling in the Node.js-based SAP Approuter used by non-Cloud-Foundry BTP applications, enabling response hijacking and DoS) and CVE-2026-44761 (CVSS 9.1, a hard-coded/default sample OAuth 2.0 client credential shipped in SAP Commerce Cloud documentation, letting an unauthenticated attacker mint valid access tokens and read/modify Commerce Cloud data via its APIs). A fourth high-severity SAP AS Java Web Container directory-traversal flaw (CVE-2026-40128, CVSS 9.0) allowing unauthorized file access/modification was reported alongside these in patch-day coverage.

No evidence of in-the-wild exploitation or a public proof-of-concept exists for CVE-2026-44747 as of disclosure, and it has not (yet) been added to the CISA Known Exploited Vulnerabilities catalog. However, SAP vulnerabilities are a persistent, high-value target for ransomware affiliates and espionage actors: CISA has added 14 separate SAP flaws to KEV since November 2021, including at least two subsequently weaponized by ransomware operators, underscoring that the historical time-to-exploitation for critical SAP kernel/NetWeaver bugs is short once technical detail becomes public. Given the low privilege bar (PR:L), the scope-changing kernel-level impact, and SAP AS ABAP's presence at the core of ERP/finance/HR/supply-chain business processes across government, manufacturing, financial services, energy, and critical-infrastructure sectors, this vulnerability should be treated as a high-priority emergency patch even absent confirmed in-the-wild activity.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1518 Software Discovery
- T1046 Network Service Discovery
- T1213 Data from Information Repositories
- T1074 Data Staged
- T1565 Data Manipulation
- T1499 Endpoint Denial of Service
- T1489 Service Stop
- T1588 Obtain Capabilities
- T1595 Active Scanning
- T1596 Search Open Technical Databases

## Sources

- [SAP Security Patch Day - July 2026 (CVE-2026-44747)](https://socradar.io/blog/sap-security-patch-day-july-2026-cve-2026-44747/)
- [SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data](https://thehackernews.com/2026/07/sap-patches-cvss-99-netweaver-abap-flaw.html)
- [NVD - CVE-2026-44747](https://nvd.nist.gov/vuln/detail/CVE-2026-44747)
- [SAP warns of critical flaws in NetWeaver and Commerce Cloud](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/)
- [SAP Patches CVE-2026-44747 (CVSS 9.9): Critical Memory Corruption Flaw in NetWeaver AS ABAP](https://securityonline.info/sap-patch-day-july-2026/)
- [SAP Security Update July 2026 - Patch for Critical SAP NetWeaver Flaw that Enables Memory Corruption](https://cybersecuritynews.com/sap-security-update-july-2026/)
- [SAP July 2026 Patch Day: CVSS 9.9 NetWeaver ABAP Flaw Leads 16 New Security Notes](https://www.cisoplatform.com/profiles/blogs/sap-july-2026-patch-day-cvss-9-9-netweaver-abap-flaw-leads-16-new)
- [SAP Note 3747367](https://me.sap.com/notes/3747367)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1438