Loading story…
SAP disclosed CVE-2026-44747, a critical memory corruption vulnerability in SAP NetWeaver Application Server ABAP, and published remediation guidance in Security Note 3747367 as part of its Security Patch Day materials. The flaw is classified as CWE-787 and affects multiple SAP ABAP kernel releases, including KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16 through 9.20.
The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was no confirmed active exploitation at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SAP released its July 2026 Security Patch Day updates, publishing 16 new security notes, one GitHub security advisory, and three updates to previously released notes. The release highlighted CVE-2026-44747 in SAP NetWeaver Application Server ABAP as the most severe issue and also called out critical flaws in SAP Approuter and SAP Commerce Cloud.
CVE-2026-44747 was recorded on July 14, 2026 as a memory corruption flaw in SAP NetWeaver Application Server ABAP. The vulnerability was classified as CWE-787 and described as allowing an authenticated attacker to cause unauthorized data access, modification, or system unavailability.
SAP released Security Note 3747367 to remediate a memory corruption vulnerability in SAP NetWeaver Application Server ABAP. The note is referenced from SAP's May 2026 Security Patch Day materials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcethehackernews.com
Open sourcethecybersecguru.com
Open sourcesecurityweek.com
Open sourcecvefeed.io
Open sourceurl.sap
Open sourcecisa.gov
Open sourceme.sap.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP patched **CVE-2025-31324**, a critical `CVSS 10.0` flaw in **SAP NetWeaver Visual Composer** that lets unauthenticated attackers send crafted HTTP `POST` requests to `/developmentserver/metadatauploader`, upload arbitrary files, and achieve remote code execution. Security researchers and national CSIRT reporting said the bug was actively exploited against exposed, high-value SAP systems, with attackers planting **JSP webshells** for persistent remote access and using the compromise to fully take over affected servers. SAP addressed the issue in **Security Note `3594142`** and urged customers to patch immediately or temporarily reduce exposure by disabling Visual Composer, disabling the `developmentserver` alias, and restricting access to the vulnerable endpoint. A second NetWeaver Visual Composer flaw, **CVE-2025-42999**, was later fixed in **Security Note `3604119`** after reports that attackers were chaining it with the first bug for stealthier post-compromise activity. That deserialization vulnerability requires high privileges but can also lead to arbitrary file upload and code execution, and researchers said exploitation had been observed since at least January 2025. Reporting linked the campaign to multiple threat actors, including **BianLian** and **RansomEXX**, with intrusions involving tools such as **Brute Ratel** and **Heaven's Gate** techniques to evade detection, prompting defenders to review uploaded files, inspect logs, and hunt for unauthorized webshells and follow-on payloads.
Jul 24, 2026
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026
SAP released its June Security Patch Day updates to fix multiple vulnerabilities across products including **SAP NetWeaver AS ABAP**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, **SAP Commerce Cloud**, **SAP Data Hub**, **SAP S/4HANA**, **SAP Business Objects Business Intelligence Platform**, and **SAP Fiori launchpad**. The issues could allow cross-site scripting, denial of service, email spoofing, sensitive information disclosure, privilege escalation, data manipulation, arbitrary code execution, and unauthorized access. The most severe flaws include **`CVE-2026-44748`**, an XML Signature Wrapping weakness in SAML authentication affecting SAP NetWeaver AS ABAP and ABAP Platform with a **CVSS 9.9**, and **`CVE-2026-40128`**, a directory traversal vulnerability in the SAP NetWeaver Application Server Java Web Container rated **CVSS 9.0**. EG-FinCIRT said organizations should apply the patches as soon as testing is complete to reduce exposure across affected SAP environments.
Jul 12, 2026