← Back to blog

SAP Patches Critical NetWeaver ABAP Flaw with CVSS 9.9 Score

SAP released July 2026 security updates addressing a critical memory corruption flaw in NetWeaver ABAP. The vulnerability could allow data exposure or modification by authenticated attackers.

TL;DR

  • SAP released patches for multiple vulnerabilities in its July 2026 update.
  • CVE-2026-44747 is a CVSS 9.9 out-of-bounds write flaw in NetWeaver ABAP.
  • An authenticated attacker could exploit it to corrupt memory and access or modify data.
  • Organizations using SAP NetWeaver should apply the updates immediately.
  • This flaw highlights the importance of timely patching for enterprise applications.

SAP has issued critical security patches as part of its July 2026 update cycle, resolving several vulnerabilities in its enterprise software suite. Among them is a high-severity memory corruption issue in SAP NetWeaver Application Server ABAP, which could be exploited by authenticated attackers to compromise data integrity.

The most critical of these flaws, tracked as CVE-2026-44747, carries a CVSS score of 9.9, indicating a severe risk to organizations running unpatched systems. Exploitation could lead to unauthorized data access or manipulation, making prompt remediation essential for affected environments.

Vulnerability Details

  • CVE-2026-44747 is an out-of-bounds write vulnerability affecting SAP NetWeaver AS ABAP.
  • It stems from improper memory management, allowing memory corruption when exploited.
  • An authenticated attacker can leverage logical errors to execute arbitrary code or manipulate data.
  • The flaw received a CVSS score of 9.9 due to its potential impact and exploitability.

Impact and Recommendations

  • Organizations using SAP NetWeaver ABAP are at risk if not patched.
  • Attackers need valid credentials but can escalate privileges or extract sensitive data.
  • SAP recommends applying the July 2026 security patches immediately.
  • Enterprises should audit their SAP environments for exposed or misconfigured systems.

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.