All Articles

SAP's July 2026 Security Patch Day landed on July 14 with 16 new security notes, 1 GitHub security advisory, and 3 updates to previously released notes. Three of the new notes carry a Critical priority.

None of the new flaws are known to be exploited as of publication. That is a window, not a pass. CISA has added 14 SAP vulnerabilities to its KEV catalog since November 2021, two of them used by ransomware operators.

The Three Criticals, In Order of Urgency

1. CVE-2026-44747: NetWeaver AS ABAP memory corruption (CVSS 9.9)

Security note 3747367 fixes an out-of-bounds write in NetWeaver Application Server ABAP, the runtime under most core SAP business systems. An authenticated attacker can abuse logical errors in memory management to corrupt memory, leading to unauthorized data access, data modification, or a full availability hit.

Affected kernel releases span 15 version lines: KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, 7.22EXT and 7.53, and KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. If you run ABAP anywhere, assume you are in scope until proven otherwise.

Per SAP guidance relayed by Onapsis, teams that cannot patch immediately can disable the relevant ICF nodes via transaction SICF as a temporary workaround. Treat that as a stopgap: ICF node inventories drift, and a node re-enabled during a support incident quietly reopens the exposure.

2. CVE-2026-27690: HTTP request smuggling in SAP Approuter (CVSS 9.1)

Security note 3720138 covers the Approuter Node.js package below version 20.10.0. An unauthenticated attacker can send a crafted HTTP request that desynchronizes request-response pairing, exposing other users' responses and enabling denial of service. Onapsis notes the issue affects Approuter deployments in non-Cloud Foundry environments.

The architectural point matters: Approuter is the authentication front door for apps on SAP Business Technology Platform. Request smuggling at the auth proxy tier breaks the session isolation every downstream app silently depends on. This is also a dependency bug, not a system patch, so it will not show up in your Basis team's note calendar. It lives in package.json files owned by app teams.

3. CVE-2026-44761: hardcoded sample credentials in Commerce Cloud (CVSS 9.1)

Security note 3753495 addresses OAuth2 clients created by sample configuration scripts that SAP previously published in its Help Portal for development and testing. The scripts configure OAuth2 clients with known credentials. Anyone who executed a sample script and kept the resulting client in production can be impersonated: an unauthenticated attacker uses the known secret to obtain access tokens and then reads or modifies data through the exposed APIs. Affected releases are HY_COM 2205 and COM_CLOUD 2211, including 2211-JDK21.

This one is configuration debt, not a code defect. Patch-cadence tooling will not flag it. The check is an audit: enumerate OAuth2 clients in your Commerce environments and hunt for the sample client IDs with unchanged secrets.

Also In This Cycle

SAP updated note 3727078, first shipped in June, for CVE-2026-40128 (CVSS 9.0), a directory traversal in NetWeaver AS Java Web Container (ENGINEAPI 7.50), extending coverage to additional packages. If you applied the June note, confirm the update does not apply to packages you deferred.

Six high-severity notes follow, including note 3758101 for multiple Apache Camel CVEs (CVE-2026-40860, CVE-2026-40453, CVE-2026-33454) in Integration Suite Edge Integration Cell below 8.43.11, and note 3692165 for a DLL hijacking flaw in SAProuter on Windows (CVE-2026-0487). The Integration Suite and Commerce Cloud notes bundle upstream Apache Camel and Tomcat fixes, a reminder that SAP estates inherit open source exposure on someone else's disclosure schedule.

Reference Table

What This Means for Security Teams

Three different failure modes are represented here, and they route to three different teams. The ABAP kernel flaw is a classic Basis patching exercise. The Approuter flaw is a dependency upgrade owned by BTP application teams. The Commerce Cloud issue is an identity hygiene audit. A single Jira ticket titled "apply SAP notes" will miss two of the three.

Recent history argues for speed. Attackers compromised official SAP npm packages in June to steal developer credentials, and exploitation of the ColdFusion flaw patched on June 30 began within hours of technical analysis publication. Assume the window between note release and working exploit is now measured in days.

Remediations and Detections

1. Apply note 3747367 across all ABAP systems, prioritizing internet-facing and production instances. Where patching lags, disable exposed ICF services via SICF and document which nodes you touched.
2. Inventory Approuter versions: search source repos and CI manifests for @sap/approuter below 20.10.0 and upgrade. Non-Cloud Foundry deployments first.
3. Audit Commerce Cloud OAuth2 clients: list all clients, flag any originating from Help Portal sample scripts, rotate or delete known-credential clients, then review API access logs for tokens issued to those client IDs going back as far as retention allows.
4. Confirm June's AS Java note 3727078 coverage against the updated package list for CVE-2026-40128.
5. Watch for early exploitation signals: unexplained ABAP short dump clusters in ST22, anomalous ICF requests in HTTP access logs, and response-mismatch errors at load balancers fronting Approuter.
6. Patch Edge Integration Cell to 8.43.11 or later and verify SAProuter Windows hosts load DLLs only from controlled paths.

Immediate Action Checklist

• Today: map which of the 15 affected ABAP kernel lines you run; schedule note 3747367.
• Today: run the Commerce Cloud OAuth2 client audit. It requires no downtime.
• This week: upgrade @sap/approuter to 20.10.0+ everywhere; re-verify June's AS Java note.
• This week: add ST22 dump anomalies and Approuter desync errors to SOC watchlists.

If you do one thing today: audit your Commerce Cloud OAuth2 clients for sample credentials. It is the only flaw in this cycle an unauthenticated attacker can exploit with a published secret, and the fix is credential rotation, not a maintenance window.

Related on CISOPlatform

• CISA's GitHub Credential Leak Postmortem: 7 Lessons Every CISO Must Act On Now
• Russian FSB Hackers Are Stealing Router Configs Over SNMP: 8 Fixes From Joint Advisory AA26-194A
• Continuous Penetration Testing in the AI Era: What Bruce Schneier Told Us

Join the Discussion

• Who owns Approuter dependency upgrades in your org: Basis, the BTP platform team, or individual app teams? How do SAP library CVEs enter your vulnerability management pipeline?
• Have you ever audited production for vendor sample scripts and default OAuth2 clients? What did you find, and what query or tooling did you use?
• What is your realistic patch SLA for a CVSS 9.9 ABAP kernel note in production ERP, and what compensating controls buy you that time?

Sources

• SAP Security Patch Day, July 2026 (official note listing)
• SecurityWeek: SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud
• BleepingComputer: SAP warns of critical flaws in NetWeaver and Commerce Cloud