SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data
SAP has rolled out updates to address multiple vulnerabilities, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leve…
Intelligence analysis by Llama
SAP has patched multiple vulnerabilities, including a critical flaw in SAP NetWeaver Application Server ABAP. The flaw allows an authenticated attacker to access, modify, or make data unavailable. The company has released updates to address the issue.
Imagine you have a super powerful computer that can do lots of things, but someone finds a way to trick it into doing something bad. That's basically what's happening with these vulnerabilities in SAP's system. The good news is that SAP has fixed the problem and released updates to protect against it.
Analysis
A Critical Flaw in SAP NetWeaver ABAP
SAP has rolled out updates to address multiple vulnerabilities, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability.
According to SAP security firm Onapsis, the vulnerability stems from a temporary workaround that proposes to disable all ICF nodes with a specific property in transaction SICF. However, this workaround will disable opening transactions in SAP GUI for HTML, making it not an option for all customers. It is strongly recommended to install the patching ABAP Kernel version.
Two Other Critical Vulnerabilities
SAP has also addressed two other critical vulnerabilities - CVE-2026-27690 (CVSS score: 9.1) and CVE-2026-44761 (CVSS score: 9.1). The first vulnerability is an HTTP request/response smuggling flaw in SAP Approuter deployments in non-Cloud Foundry environments that allows an unauthenticated attacker to send a specially crafted HTTP request that leads to request-response desynchronization and results in the exposure of user responses and triggers denial-of-service (DoS) attacks.
The second vulnerability is a use of default credentials flaw in SAP Commerce Cloud that could retain a sample OAuth 2.0 client with publicly documented sample credentials originating from a sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.
Implications and Recommendations
Although there is no evidence of the flaws being exploited in the wild, it's advised to apply the necessary updates for optimal protection. Customers are recommended to audit their production environments for the presence of the affected sample OAuth 2.0 client. If the client exists, it must be removed. It's also worth noting that customers who removed the sample client or replaced the secret with a strong, unique value are not impacted by the bug.
Key points
- SAP has patched multiple vulnerabilities, including a critical flaw in SAP NetWeaver Application Server ABAP.
- The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or syste…
- SAP has also addressed two other critical vulnerabilities - CVE-2026-27690 (CVSS score: 9.1) and CVE-2026-44761 (CVSS score: 9.1).
- Customers are advised to apply the necessary updates for optimal protection and to audit their production environments for the presence of the affected sample OAuth 2.0 client.
If the necessary updates are applied, the risk of exploitation can be significantly reduced. Additionally, customers who have already removed the sample OAuth 2.0 client or replaced the secret with a strong, unique value are not impacted by the bug.
If the updates are not applied, the risk of exploitation remains high. Additionally, if the affected sample OAuth 2.0 client is not removed, an unauthenticated attacker could use the well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.
