# SAP Patches Critical 9.9 CVSS NetWeaver ABAP Vulnerability High-risk flaw exposing data security has been addressed in latest updates. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/22ed9afe-ea33-4f35-8bf3-1e8fa31585c5 ## Critical Vulnerability Discovered SAP addressed a critical vulnerability (CVE-2026-44747, CVSS 9.9) in NetWeaver Application Server ABAP as part of July 2026 security updates. This out-of-bounds write flaw allows authenticated attackers to exploit logical errors in memory management, potentially leading to unauthorized data access or modification. ## Temporary Workaround Security firm Onapsis suggested temporarily disabling specific ICF nodes as an interim solution. However, this workaround prevents opening transactions in SAP GUI for HTML, making it unsuitable for all customers. Experts strongly recommend installing the patched ABAP Kernel version for comprehensive protection. ## Additional Critical Fixes SAP also patched two other critical vulnerabilities: CVE-2026-27690 allows HTTP request/response smuggling in non-Cloud Foundry environments, while CVE-2026-44761 involves default credentials in SAP Commerce Cloud that could enable attackers to read and modify data through certain APIs. ## Sample Configuration Risk The vulnerability originated from sample configuration scripts previously provided in SAP Help Portal. These scripts, meant for development/testing, configured OAuth 2.0 clients with hard-coded credentials. Older documentation versions didn't explicitly warn against using these default settings in production environments. ## Unaffected Customers Customers who removed the sample client or replaced the default secret with a strong, unique value aren't impacted. SAP recommends auditing production environments for the presence of the affected OAuth 2.0 client and removing it if found to ensure system security. ## Update Imperative While there's no evidence of active exploitation, applying these updates is crucial for maintaining system security. The patches are particularly vital for industries like finance and healthcare where operational continuity and data integrity are paramount concerns. ## Sources covering this story - https://thehackernews.com/2026/07/sap-patches-cvss-99-netweaver-abap-flaw.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._