# SAP Patches Three Critical Vulnerabilities in NetWeaver, AppRouter, and Commerce Cloud


SAP has released emergency security updates addressing 16 vulnerabilities across its product suite, including three critical flaws that could allow attackers to compromise memory, bypass authentication, and access sensitive business data. The German software giant—which serves 99 of the Fortune 100—has rated these patches with maximum urgency as enterprises face mounting pressure to patch before threat actors weaponize the flaws.


## The Threat


Three critical vulnerabilities demand immediate attention across SAP deployments:


Memory Corruption in NetWeaver (CVE-2026-44747)

The most severe flaw affects SAP NetWeaver Application Server ABAP, the runtime environment powering core SAP enterprise applications. An authenticated attacker can trigger an out-of-bounds write vulnerability in memory management, potentially leading to:

  • Unauthorized data access across application memory
  • Data modification of critical business records
  • System unavailability through denial-of-service conditions

    • SAP describes this as having "high impact on confidentiality, integrity, and availability," making it a natural target for attackers seeking to pivot from initial access.


    HTTP Request Smuggling in AppRouter (CVE-2026-27690)

    A second critical flaw exists in SAP AppRouter, the Node.js-based middleware library used to route requests to cloud applications on SAP's Business Technology Platform (BTP). Unlike the NetWeaver flaw, this vulnerability requires no authentication:

  • Unauthenticated attackers craft malicious HTTP requests
  • Responses intended for legitimate users become visible to attackers
  • Denial-of-service attacks can disable targeted applications
  • This flaw exposes organizations using SAP BTP to immediate risk regardless of internal network controls

    • Default Credentials in Commerce Cloud (CVE-2026-44761)

    The third critical vulnerability stems from hardcoded or default credentials in SAP Commerce Cloud, the enterprise e-commerce platform. Attackers can:

  • Obtain valid access tokens using default credentials
  • Read or modify customer data through exposed APIs
  • Bypass intended authentication mechanisms entirely

    • For organizations running e-commerce operations on Commerce Cloud, this flaw creates an immediate risk of customer data theft and transaction manipulation.


    ## Background and Context


    SAP's July 2026 patch Tuesday represents part of an escalating vulnerability trend affecting the company's product ecosystem. Beyond the three critical flaws, the advisory addresses:


    | Severity | Count | Vulnerability Types |

    |----------|-------|----------------------|

    | Critical | 3 | Memory corruption, HTTP smuggling, default credentials |

    | High | 6 | DLL hijacking, open redirect, missing authorization, RCE |

    | Medium | 7 | XSS, path traversal, SQL injection, DoS, information disclosure |

    | Low | 1 | Security misconfiguration |


    This month's release follows June 2026, when SAP patched 15 vulnerabilities. More critically, the company disclosed a supply chain attack targeting its official npm packages—a sign that threat actors are systematically targeting SAP's development infrastructure and ecosystem.


    The historical record underscores the pattern: the Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its Known Exploited Vulnerabilities catalog since November 2021, including two flaws weaponized by ransomware gangs. SAP's dominance—serving 99 of the world's 100 largest companies—makes each vulnerability a high-value target across finance, healthcare, manufacturing, and retail sectors.


    ## Technical Details


    Memory Corruption Attack Vector

    The NetWeaver flaw (CVE-2026-44747) requires an authenticated user, suggesting the risk materializes after initial compromise or credential theft. The out-of-bounds write condition allows attackers to:

  • Overwrite adjacent memory regions
  • Leak sensitive data from application memory (customer records, transaction details, encryption keys)
  • Execute arbitrary code by corrupting function pointers or return addresses

    • HTTP Smuggling Exploitation

    Request smuggling exploits discrepancies between how HTTP servers and intermediaries parse requests. In AppRouter, attackers can:

    1. Send ambiguous HTTP requests that parse differently at the gateway vs. backend application

    2. Inject requests into other users' sessions

    3. Access cached responses containing authentication tokens or sensitive data

    4. Trigger resource exhaustion through algorithmic complexity attacks


    Default Credentials Persistence

    Commerce Cloud's reliance on default credentials indicates insufficient hardening during deployment. Organizations may inherit insecure configurations from:

  • Template deployments never customized post-install
  • Development environments promoted to production without credential rotation
  • Backup systems restored with original default credentials intact

    • ## Implications


    Enterprise Attack Surface Expansion

    SAP's ubiquity means these flaws create a massive attack surface. An attacker gaining initial access to a single SAP user account (via phishing, credential reuse, or malware) can leverage CVE-2026-44747 to escalate privileges and access enterprise-wide data. The absence of authentication requirements for CVE-2026-27690 means cloud-hosted applications require zero compromise—direct internet access enables attacks.


    Supply Chain Risk Cascade

    The recent npm package compromises signal a tactical shift: threat actors are poisoning SAP's development supply chain to target downstream users. This month's patches arrive alongside elevated awareness that patching SAP is organizationally difficult—large enterprises often run dozens of SAP instances across business units, each with different patch cycles and change-control processes.


    E-Commerce and Customer Data

    Organizations using SAP Commerce Cloud for customer-facing transactions face immediate risk of payment data, personal information, and transaction history exposure. Unlike internal-only systems, e-commerce platforms are public-facing and regularly scanned by automated attack tools.


    ## Recommendations


    Immediate Actions (Today)

    1. Identify all SAP systems in your environment — NetWeaver, Commerce Cloud, and BTP instances require separate patch cycles

    2. Audit for default credentials in Commerce Cloud deployments; rotate all default credentials immediately

    3. Isolate AppRouter instances from public internet exposure or apply network-level controls (WAF, rate limiting) to block malicious HTTP patterns


    Short-Term Patching (This Week)

  • NetWeaver instances: Prioritize systems with authenticated user access from untrusted networks (remote workers, partner integrations)
  • Commerce Cloud: Patch all customer-facing instances before retail/e-commerce peak seasons
  • AppRouter: Test patches in non-production BTP environments first, then deploy to production with rollback plans

    • Longer-Term Hardening

  • Implement SAP security monitoring through SIEM integration to detect exploitation attempts (memory access violations, unusual API token usage)
  • Adopt secure credential management — eliminate default credentials through automated provisioning and secrets vaults
  • Establish SAP patch baselines with predictable monthly update windows to improve organizational readiness

    • ## HackWire Analysis


    The pattern here is worth naming: SAP has become a favored attack vector precisely because enterprises treat it as stable infrastructure. Most organizations patch web browsers monthly and operating systems quarterly, but SAP instances—often running mission-critical financial, supply chain, and customer systems—receive patches on irregular schedules, sometimes months apart. Threat actors have adapted by accumulating SAP flaws in exploit repositories, waiting for the gap between discovery and deployment.


    This month's default credentials flaw in Commerce Cloud reveals a second, more troubling pattern: API security remains underfunded in enterprise platforms. Default credentials should never reach production in 2026—yet SAP's own e-commerce platform shipped with them. This suggests that security testing is happening downstream (after customers deploy), not upstream in SAP's development pipeline.


    The HTTP smuggling flaw in AppRouter deserves special attention because it's unauthenticated and stateless: attackers don't need prior reconnaissance or valid credentials. Any developer or security team using AppRouter must assume this flaw is under active exploitation *right now*, not "will be in a few weeks." CISA will likely add this to Known Exploited Vulnerabilities within days.


    For defenders, the strategic implication is clear: SAP patch frequency is insufficient. Monthly patches mean 30-day windows where organizations are either vulnerable or incurring testing/deployment costs. Some enterprises will choose not to patch, gambling that they're not targeted. That math changes as ransomware gangs continue to weaponize SAP flaws—a pattern we've seen twice in CISA's KnownExploited catalog already.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)