This week, SAP, a leading enterprise software provider, announced the release of several critical security patches as part of its regular July 2026 update cycle. Notably, 19 new and revised security advisories were issued, aiming to address significant vulnerabilities within its systems.
Key Vulnerabilities in NetWeaver
The most pressing of these vulnerabilities is identified as CVE-2026-44747, which impacts the NetWeaver Application Server ABAP. With a CVSS score of 9.9, this memory corruption issue poses significant risks, potentially allowing unauthorized data access and manipulation as well as system downtime. Experts from SAP’s security partner, Onapsis, stress the importance of implementing these patches promptly. For those unable to apply the updates immediately, a temporary fix involves disabling specific ICF nodes via transaction SICF.
Critical Flaws in Approuter and Commerce Cloud
Another noteworthy vulnerability, CVE-2026-27690, affects SAP Approuter in environments outside of Cloud Foundry. This HTTP request smuggling flaw, with a CVSS rating of 9.1, could enable attackers to desynchronize request-response cycles through crafted HTTP requests, potentially leading to unauthorized access. Similarly, SAP’s Commerce Cloud faced a critical issue, CVE-2026-44761, involving hardcoded credentials in OAuth2 client configurations. This could result in unauthorized data access if the sample scripts are executed without modification.
The vulnerability in Commerce Cloud highlights the risk of using sample scripts with default settings in production environments. While SAP’s updated documentation now warns against this practice, it is advised that organizations review their environments to ensure compliance and security.
Additional Security Measures and Updates
In addition to these critical vulnerabilities, SAP updated a previous note concerning a NetWeaver issue initially addressed in June, extending support to additional packages. Furthermore, six security advisories were released focusing on high-severity defects across various SAP products, including Integration Suite and SAProuter. These updates also encompass patches for vulnerabilities in Apache Camel and Apache Tomcat, used within some SAP solutions.
The remaining notes cover medium- and low-severity issues affecting several SAP platforms, such as S/4HANA, Fiori, CRM, and HANA Extended Application Services Classic Model. These updates are essential for maintaining robust security and protecting enterprise systems from potential threats.
As cyber threats continue to evolve, it is crucial for SAP users to stay informed and proactive in applying these updates to safeguard their systems.
