SAP NetWeaver AS ABAP memory-corruption via logical errors in memory management
Authenticated memory-corruption in NetWeaver Application Server ABAP that NVD scored 9.9 — a logged-in attacker can leverage logical errors in memory management to read data, modify data, or take the application down. Fixed in the SAP July 2026 Security Patch Day.
- Vendor
- SAP
- Product
- NetWeaver Application Server ABAP (see body — version details in SAP's July 2026 Security Note)
- CVSS
- 9.9
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
Is CVE-2026-44747 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-44747 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.6% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
An authenticated memory-corruption flaw in SAP NetWeaver Application Server ABAP. NVD assigns CVSS 3.1 = 9.9, which is the top of the “critical” band for a bug that still requires the attacker to hold valid credentials — high impact on confidentiality, integrity, and availability all three.
What the flaw is (per NVD): “SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability.”
The base score sits at 9.9 rather than the unauthenticated-RCE ceiling of 10 because the attacker needs to be logged in — but 9.9 also implies the exploitation path is otherwise clean once authenticated: no user interaction, network-reachable, and the impact axes all rated high. In a NetWeaver ABAP context that “authenticated” precondition is not much of a wall; ABAP application servers hold service accounts, batch users, and RFC connections that often outnumber human accounts, and any of those in an attacker’s hands is enough.
Status: SAP fixed this on the July 2026 Security Patch Day (published 2026-07-14). No known exploitation in the wild at time of writing, per BleepingComputer’s summary of the patch day.
What to do: Apply the July 2026 SAP Security Note that references this CVE (SAP’s Support Portal is gated; the Note ID is called out in the SAP Security Patch Day landing page for authenticated customers). Until the note is applied, treat any high-value ABAP service account as one credential leak away from a 9.9-scored problem.
- SAP July 2026 Security Patch Day — SAP Support Portal (authenticated).
- BleepingComputer coverage, 2026-07-14.
- NVD entry.
Other SAP CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-58231 SAP Commerce Cloud Data Hub Adapter Unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-44761 SAP Commerce Cloud ships sample OAuth2 client with publicly documented credentialswrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-27690 SAP AppRouter HTTP request smuggling in Node.js middlewarewrite-up | [ CRITICAL ] | 9.1 | 0.7% | — |
| CVE-2025-42999 SAP NetWeaver Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.1 | 12.7% | |
| CVE-2025-31324 SAP NetWeaver Unrestricted File Upload Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 99.5% | |
| CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability | [ HIGH ] | 7.5 | 95.1% | |
| CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 7.1% | |
| CVE-2022-22536 SAP Multiple Products HTTP Request Smuggling Vulnerability | [ CRITICAL ] | 10.0 | 97.9% |
