SAP has released urgent security updates to address high-severity flaws in NetWeaver, Approuter, and Commerce Cloud that could lead to data breaches.

Key Takeaways

  • SAP released 19 security notes in its July 2026 patch cycle.
  • A critical memory corruption bug (CVE-2026-44747) in NetWeaver scored a near-perfect 9.9 CVSS rating.
  • Commerce Cloud faced risks due to hardcoded credentials in sample scripts.
  • Immediate patching is advised to prevent unauthorized data access and system downtime.

Enterprise software giant SAP has announced the release of 19 new and updated security notes as part of its July 2026 security patch cycle. These updates target several critical vulnerabilities across its core product suite, including NetWeaver, Approuter, and Commerce Cloud, aiming to protect global enterprises from sophisticated cyberattacks.

High-Severity Threats in NetWeaver and Approuter

The most alarming vulnerability identified is CVE-2026-44747, a memory corruption bug within the NetWeaver Application Server ABAP. With a staggering CVSS score of 9.9, this flaw poses a catastrophic risk. According to cybersecurity firm Onapsis, successful exploitation could allow attackers to gain unauthorized access, modify critical business data, and trigger complete system unavailability.

Furthermore, a critical HTTP request smuggling vulnerability (CVE-2026-27690) was addressed in the Approuter. This flaw specifically affects deployments in non-Cloud Foundry environments, enabling unauthenticated attackers to desynchronize request-response cycles, potentially bypassing security controls.

The Commerce Cloud Credential Risk

Another significant security lapse was discovered in SAP Commerce Cloud, tracked as CVE-2026-44761. This issue stems from hardcoded credentials found in sample configuration scripts originally intended for development and testing. If these scripts are mistakenly migrated to a production environment, attackers can use the known credentials to obtain access tokens and tamper with sensitive system APIs.

Experts warn that while SAP has now addressed this lapse in their documentation, customers must proactively audit their production environments to ensure no legacy sample clients remain active with default secrets.

Comprehensive Security Strengthening

Beyond these major flaws, the July update also includes patches for Integration Suite, S/4HANA, and Fiori. The release also addresses several vulnerabilities related to Apache Camel and Apache Tomcat. For organizations managing these systems, the mandate is clear: apply the latest security notes immediately to mitigate the risk of exploitation.