SAP July 2026 Patches: 9.9 CVSS NetWeaver Flaw, 2 More Critical Fixes

SAP's July 2026 Patch Day delivered a critical wake-up call for the enterprise IT world, releasing 19 new and updated security notes that address a trio of critical vulnerabilities across its core product suite. The most severe, CVE-2026-44747, carries a near-maximum CVSS score of 9.9 and affects NetWeaver Application Server ABAP—the runtime environment underpinning a vast array of SAP business applications. This memory corruption bug, stemming from an out-of-bounds write weakness, allows an authenticated attacker to abuse logical errors in memory management to access, modify, or deny service to mission-critical systems. Onapsis, a leading SAP security firm, emphasizes that successful exploitation compromises confidentiality, integrity, and availability entirely. While a patch is the definitive fix, SAP also provides a temporary workaround: disabling all ICF nodes with a specific property in transaction SICF. The second critical flaw, CVE-2026-27690 (CVSS 9.1), is an HTTP Request Smuggling vulnerability in Approuter, the Node.js middleware library that routes traffic for cloud-based SAP applications on the Business Technology Platform. In non-Cloud Foundry deployments, an unauthenticated attacker can send a specially crafted HTTP request to desynchronize responses, gaining access to other users' responses and triggering denial-of-service attacks. This is particularly concerning for organizations running hybrid cloud environments where Approuter bridges on-premises and cloud services. The third critical issue, CVE-2026-44761 (CVSS 9.1), was found in SAP Commerce Cloud and involves hardcoded credentials in sample configuration scripts previously provided for development and testing. These scripts configure OAuth2 clients with known secrets; if a customer runs the sample script and accidentally retains the resulting OAuth2 client in production without replacing the hardcoded secret, an unauthenticated attacker can obtain a valid access token. That token enables them to invoke specific APIs and read or tamper with system data. Crucially, customers who removed the sample client or replaced the secret with a unique, strong value are unaffected, making this a classic configuration hygiene issue. Beyond the three critical bugs, SAP's July 2026 advisory includes six high-severity flaws, seven medium, and one low—encompassing DLL hijacking, open redirects, missing authorization checks, remote code execution, cross-site scripting (XSS), path traversal, SQL injection, denial-of-service, information disclosure, and security misconfigurations. The breadth of these weaknesses underscores the persistent attack surface within monolithic and cloud-native SAP landscapes. Contextually, the enterprise software giant has seen growing attention from threat actors and regulatory bodies. CISA previously added 14 SAP security flaws to its Known Exploited Vulnerabilities (KEV) catalog, though SAP states it has not found evidence that the newly disclosed July 2026 vulnerabilities have been exploited in the wild. That does not diminish the urgency, as security researchers note that SAP vulnerabilities, once disclosed, quickly attract scanning and exploit attempts. With tens of thousands of organizations globally running SAP for finance, supply chain, HR, and manufacturing, any unpatched system represents a potential entry point for data theft, ransomware, or sabotage. The patch day also highlights the ongoing shift in attack techniques from simple perimeter exploits to more nuanced application-layer attacks like HTTP smuggling and memory corruption. For defenders, the immediate priority is to inventory NetWeaver ABAP, Approuter, and Commerce Cloud instances and assess exposure. The Approuter flaw, in particular, may affect organizations that migrated to SAP BTP but retained older, non-Cloud Foundry deployment models. The Commerce Cloud hardcoded credential issue, while confined to a specific misconfiguration, could be widespread given the common practice of using sample scripts in development without proper cleanup. Overall, the July 2026 patch set reinforces the need for a routine, rapid patch management cadence paired with verification that production systems are free of default or sample configurations. As SAP continues to evolve its platform, the security community will be watching closely for how quickly these critical patches are adopted and whether exploit attempts emerge in the weeks ahead.