SAP July 2026 security patches: how to triage CVE-2026-44747

On 14 July 2026, SAP published 16 new security notes, one GitHub advisory and three updates to earlier notes. The highest-priority issue is CVE-2026-44747 in SAP NetWeaver Application Server ABAP, scored CVSS 9.9. Two further critical vulnerabilities—HTTP request smuggling in SAP Approuter and insecure sample credentials in SAP Commerce Cloud—score 9.1.

This is not a ticket that should stop at forwarding CVE numbers to an administrator. Organisations need to establish which components are actually running, who can authenticate to them, where trust boundaries sit and whether remediation truly closes the risk.

The critical queue

Priority	Vulnerability	Product	Score
1	CVE-2026-44747 — memory corruption	SAP NetWeaver AS ABAP	9.9
2	CVE-2026-27690 — HTTP request smuggling	SAP Approuter before 20.10.0	9.1
3	CVE-2026-44761 — insecure sample credentials	SAP Commerce Cloud	9.1

The bulletin also includes a critical update for CVE-2026-40128 in NetWeaver AS Java and several high- and medium-severity issues. An inventory that only covers the three headline vulnerabilities is therefore incomplete.

CVE-2026-44747: why it scores 9.9

According to the SAP-issued record, a low-privileged authenticated attacker can exploit memory-management errors in NetWeaver AS ABAP. The potential consequences include unauthorised data access, modification and system unavailability.

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Operationally, that means:

• the attack is network reachable;
• no user interaction is required;
• a low-privileged account is required, but not an administrator;
• impact can cross the original security scope;
• confidentiality, integrity and availability impact are all rated high.

Authentication should not create false comfort. SAP accounts may be available to large user populations, integrations and technical services. A compromised identity, weak password or exposed integration credential can supply the required starting position.

CVE-2026-27690: ambiguity at the HTTP boundary

SAP Approuter versions before 20.10.0 are affected by HTTP request smuggling. This vulnerability class occurs when intermediary components disagree about where one request ends and the next begins. A parsing difference between a reverse proxy, load balancer and backend can allow a second request to be smuggled through the chain.

Do not assume a WAF solves the issue. If the WAF and application parse traffic differently, the control may inspect a different request from the one processed by the backend. Upgrade Approuter as directed by SAP and then validate the complete proxy path.

Post-update testing should cover:

1. Content-Length and Transfer-Encoding normalisation;
2. duplicate and conflicting headers;
3. backend connection reuse and timeouts;
4. correlated request identifiers at every layer;
5. any mismatch between client-visible and backend behaviour.

CVE-2026-44761: sample credentials become a production problem

CVE-2026-44761 concerns insecure sample credentials in SAP Commerce Cloud. Treating it as “only a development configuration” would be an operational mistake. Demo identities, bootstrap accounts and sample secrets often travel between environments through images, pipelines and copied configuration.

After applying the fix:

• identify every account and secret derived from sample configuration;
• revoke them rather than merely changing documentation;
• review authentication and activity associated with those identities;
• search images, backups, repositories and CI/CD systems;
• confirm that a newly created environment does not restore the weakness from a template.

Response plan for administrators and security leaders

First four hours

1. Export the inventory of SAP systems, kernel versions, Approuter instances and Commerce Cloud environments.
2. Assign a technical and business owner to each instance.
3. compare installed versions with the official bulletin and SAP notes.
4. Label exposure from the Internet, partner networks and broad internal segments.
5. Preserve logs before rotation and begin reviewing unusual authentication.

Within 24 hours

1. Apply fixes in order of impact and exposure.
2. If maintenance must wait, restrict network access and identities that can reach the affected component.
3. Rotate or revoke credentials that could provide an entry point.
4. Monitor unusual process faults, crashes, HTTP discrepancies and out-of-pattern account activity.

Within 72 hours

1. Confirm the effective version on each host, not merely the deployment job status.
2. Run a negative test against the remediated path.
3. Review dependencies, integrations and disaster-recovery systems.
4. Record patch evidence, validation results and residual risk.
5. Close exceptions only after the risk owner accepts the evidence.

What remains unknown

At the time of writing, official sources confirm the vulnerabilities and available fixes but do not report publicly confirmed active exploitation of CVE-2026-44747. That absence is not evidence that attacks have not occurred; it is only a boundary on currently available information.

Do not tell stakeholders “we were not attacked” solely because the SIEM produced no alert. First establish whether the relevant events were logged, retained and capable of being correlated.

Evidence required to close remediation

“Patch installed” is an operational status, not complete security evidence. A defensible closure package includes:

• the effective component version read from the target system;
• a controlled negative test of the vulnerable path;
• a business-process regression test;
• log review covering the pre-patch exposure window;
• confirmation that recovery systems and deployment images are also safe;
• owner, date and any residual-risk statement.

Where SAP sits inside a broader environment, combine technical validation with an IT security audit or targeted testing of connected applications and APIs. Material risk often exists at the intersection of the platform, integration, identity and network—not inside one vendor note.

Primary and government sources: SAP Security Patch Day — July 2026, SAP KBA 3779058, NVD — CVE-2026-44747, Cyber Security Agency of Singapore — alert AL-2026-087.