# SAP Patches Three Critical Flaws Including Memory Corruption and Hardcoded OAuth2 Credentials
SAP released 20 security patches on Tuesday as part of its July 2026 patch cycle, addressing multiple vulnerabilities across its enterprise application portfolio. Among the updates are three critical-severity flaws that could allow unauthenticated attackers to access and modify data, crash systems, and bypass authentication entirely. Organizations running NetWeaver, Approuter, or Commerce Cloud deployments should prioritize these patches immediately.
## The Threat
The vulnerabilities span three critical product areas and expose different attack surfaces. The most severe is a memory corruption bug in SAP NetWeaver Application Server ABAP that allows attackers to read and modify system data and trigger denial-of-service conditions without authentication. The second is an HTTP request smuggling defect in Approuter that enables request-response desynchronization attacks, permitting unauthorized API access. The third involves hardcoded OAuth2 client credentials that were embedded in sample configuration scripts provided by SAP for Commerce Cloud development and testing—a classic case of reference code that organizations adopted into production without changing security defaults.
What makes this patch cycle particularly significant is the combination of pre-authentication vectors and the ubiquity of the affected products. SAP's enterprise application suite runs critical business processes for the majority of Fortune 500 companies. NetWeaver is the foundation of many legacy and modern SAP deployments, Approuter is deployed across cloud and on-premises environments, and Commerce Cloud handles sensitive transactional data and payment flows. A single unpatched instance in any of these products could grant an attacker broad access to enterprise financial, customer, and operational data.
The hardcoded credentials issue in Commerce Cloud deserves particular attention because it represents a documentation and default-security failure. SAP provided sample configuration scripts that set up OAuth2 clients with known, predictable credentials—intended for development and testing only. However, older documentation did not explicitly warn customers against deploying these sample configurations into production. Many organizations likely copied the scripts, deployed the credentials without change, and have silently been exposing OAuth2 access tokens to any attacker who knows the default secret. This is the kind of vulnerability that can lie dormant for months or years before discovery.
## Severity and Impact
| CVE | CVSS Score | Vector String | CWE | Attack Complexity | Authentication | Impact |
|-----|-----------|---|---|---|---|---|
| CVE-2026-44747 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | CWE-119 (Improper Restriction of Operations within Bounds of Memory Buffer) | Low | None Required | Data Access, Data Modification, Denial of Service |
| CVE-2026-27690 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | CWE-444 (Inconsistent Interpretation of HTTP Requests) | Low | None Required | Request Smuggling, API Bypass, Data Access |
| CVE-2026-44761 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | CWE-798 (Use of Hard-coded Credentials) | Low | None Required | Data Access, Data Modification, Token Generation |
Additional vulnerabilities addressed in this patch cycle include six high-severity defects across Integration Suite (Edge Integration Cell), SAProuter, NetWeaver Application Server Java (Configuration Wizard), and multiple instances of Apache Camel and Apache Tomcat bugs in Commerce Cloud and Integration Suite deployments. The remaining patches address medium- and low-severity issues affecting NetWeaver, S/4HANA, Fiori, CRM, and HANA Extended Application Services Classic Model.
## Affected Products
NetWeaver Application Server ABAP:
Approuter:
Commerce Cloud:
SAP Integration Suite:
SAProuter:
Additional Products:
## Mitigations
Immediate Actions:
Organizations should treat the three critical vulnerabilities (CVE-2026-44747, CVE-2026-27690, CVE-2026-44761) as priority-one patches and test them in non-production environments before broad deployment. SAP has released fixes for all three vulnerabilities, and customers should plan patch application within the next 72 hours.
Temporary Workarounds:
For CVE-2026-44747 (NetWeaver memory corruption), SAP provides an interim workaround: disable all ICF (Internet Communication Framework) nodes with the affected property using transaction SICF. This reduces attack surface while patches are tested and deployed, though it may impact application functionality depending on which ICF services are in use.
For CVE-2026-27690 (Approuter HTTP smuggling), organizations should restrict HTTP traffic to Approuter instances at the network level, require TLS 1.2 or higher, and implement strict Host header validation until patches are applied.
Audit and Remediation for CVE-2026-44761:
Organizations running Commerce Cloud must audit their production environments immediately for the presence of hardcoded OAuth2 client credentials, particularly those deployed via SAP sample configuration scripts. Any instance that retains the default credentials should be remediated by either removing the OAuth2 client or replacing the secret with a strong, cryptographically random value. Customers who already removed the sample configuration or replaced credentials with unique values are not affected.
Patch Testing Strategy:
Given the breadth of this patch cycle (20 notes), prioritize by CVSS score and your organization's deployment footprint. Test patches against the specific version combinations and configurations you operate. Given the memory corruption severity of CVE-2026-44747, test NetWeaver patches thoroughly for stability and performance impact before production rollout.
## References
## HackWire Analysis
This patch cycle reveals a persistent truth about enterprise software: as products accumulate features and integrations, the security perimeter expands exponentially. SAP's three critical flaws in a single month demonstrate the ongoing tension between functional breadth and security hardening in complex platforms.
The hardcoded credentials vulnerability in Commerce Cloud is particularly instructive. This is not a novel attack vector—default or sample credentials have been exploited for decades—yet it still appears in production systems because SAP's documentation lagged behind its code samples. Developers copy example configurations for speed, inherit them across projects, and rarely audit the security posture of reference material. The fact that older SAP Help Portal documentation did not explicitly warn against production deployment suggests that security guidance was reactive rather than proactive. This is a systemic issue across the software industry, not unique to SAP, but it remains expensive to fix: organizations now face the burden of auditing their entire OAuth2 client inventory to identify which secrets are known.
The memory corruption bug (CVE-2026-44747) with a CVSS of 9.9 is particularly notable because it affects NetWeaver ABAP, which remains the backbone of SAP's largest and most entrenched deployments. NetWeaver has been the foundation of enterprise resource planning (ERP) for decades, meaning that many Fortune 500 companies are running vulnerable infrastructure as we speak. The question is not whether attackers will target this vulnerability—they will—but how quickly enterprises can patch without disrupting mission-critical business operations. For organizations that have not implemented automated patching pipelines, this creates genuine operational risk over the coming weeks.
The HTTP request smuggling vulnerability in Approuter (CVE-2026-27690) adds another layer of concern: it affects non-Cloud Foundry deployments, meaning both on-premises and hybrid cloud environments are exposed. This is particularly relevant for organizations in the midst of cloud migration, where Approuter may be operating as a gateway between legacy on-premises systems and cloud-hosted services. An attacker exploiting request smuggling could potentially bypass authentication controls or route traffic to unintended backends, turning Approuter from a security boundary into a liability.
Defenders should approach this patch cycle methodically: prioritize by CVSS and your deployment footprint, test thoroughly before rollout, and immediately audit for the hardcoded OAuth2 credentials issue in Commerce Cloud. This is not a "patch and move on" situation—it requires verification and forensics.
— *HackWire Editorial*
## Related Coverage