Critical Memory Corruption Vulnerability in SAP NetWeaver AS ABAP Allows Authenticated Data Compromise (CVE-2026-44747)
July 22nd, 2026
Critical
Our Cyber Threat Intelligence Unit is monitoring a critical memory-corruption vulnerability in SAP NetWeaver Application Server ABAP (AS ABAP), tracked as CVE-2026-44747 and disclosed on July 14, 2026, as part of SAP's July 2026 Security Patch Day. SAP NetWeaver AS ABAP is the core runtime environment and application server underpinning most SAP enterprise software, so a critical vulnerability at this layer directly affects the foundation of an organization's ERP estate. An authenticated attacker with low privileges can remotely exploit logical errors in memory management to trigger memory corruption, allowing unauthorized data access, data modification, and system unavailability. SAP has released Security Note 3747367 with a fix and provided a temporary workaround for organizations that cannot patch immediately. No public reports confirm active exploitation of CVE-2026-44747 as of this publication. However, its network-exploitable, low-privilege-authentication profile and position within the core ABAP kernel make it a high-priority target; SAP NetWeaver components have been the subject of prior actively exploited vulnerabilities, including two added to CISA's Known Exploited Vulnerabilities catalog in 2025 that ransomware groups were observed exploiting.
Technical Details
Threat Type: Memory Corruption (CWE-787: Out-of-Bounds Write).
Severity: CVSS 3.1 Base Score 9.9 (Critical), assigned by CNA SAP SE; NVD independent assessment not yet published.
Weakness Type: CWE-787: Out-of-Bounds Write.
Affected Component: SAP NetWeaver Application Server ABAP kernel memory management subsystem.
Affected Versions: KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, 9.20
Platforms Affected: All platforms supporting SAP NetWeaver AS ABAP, including Linux, Windows, AIX, and z/OS.
CVE ID: CVE-2026-44747
Attack Chain:
Initial Access: An authenticated attacker with low-privilege network access to SAP NetWeaver AS ABAP sends specially crafted requests to the ABAP kernel; no user interaction is required.
Exploitation: The out-of-bounds write condition corrupts kernel-level memory, allowing the attacker to alter program execution flow or access data outside authorized boundaries.
Scope Escalation: The CVSS scope-change rating (S:C) indicates that impact can extend beyond the directly compromised kernel component into dependent SAP systems and services sharing the same infrastructure.
Post-Exploitation: With memory corruption achieved, an attacker can pursue unauthorized data access, modify business-critical ERP data, or cause sustained system unavailability across the affected NetWeaver environment.
Impact
• Core ERP Infrastructure at Risk: CVE-2026-44747 targets the SAP NetWeaver AS ABAP kernel, the foundation of most SAP enterprise deployments; compromise at this layer directly affects all business processes, data, and services running on the affected system.
• Authenticated Low-Privilege Exploitation: The low-privilege requirement means any authenticated SAP user, not just administrators, can serve as a potential attacker or a compromised account from which to launch exploitation.
• Full Confidentiality, Integrity, and Availability Impact: Successful exploitation allows unauthorized data access, data modification, and service disruption, with high impact across all three security pillars simultaneously.
• Scope Change into Dependent Systems: The S:C CVSS rating means exploitation can cascade beyond the directly affected kernel component, amplifying the blast radius into other SAP systems and dependent business processes.
• Broad Kernel Version Coverage: The vulnerability spans legacy and current SAP kernel releases from 7.22 through 9.20, meaning both older and recently patched NetWeaver environments may be affected without applying SAP Note 3747367.
• Recurring SAP Attack Surface: SAP NetWeaver components have previously been targeted in active exploitation campaigns; in 2025, CISA added two actively exploited SAP NetWeaver vulnerabilities to its Known Exploited Vulnerabilities catalog after ransomware groups exploited them, underscoring the importance of prompt patching for internet-facing or business-critical SAP deployments.
Detection Method
• Kernel and Process Monitoring: Review SAP system logs and kernel dumps for unexpected memory errors, process crashes, or out-of-bounds access events in the NetWeaver AS ABAP kernel, particularly those originating from low-privileged user sessions.
• ICF Traffic Monitoring: Monitor ICF (Internet Communication Framework) service access logs for unusual traffic patterns to service nodes, especially if the SICF workaround has been applied, as any access to disabled nodes may indicate active probing or exploitation attempts.
• SIEM Correlation: Correlate SIEM alerts for unexpected data access, unauthorized configuration changes, or privilege escalation events in SAP NetWeaver environments following the July 14, 2026, disclosure date.
• Audit Log Review: Review SAP audit logs for anomalous activity from low-privileged user accounts, including unusual API calls, unexpected report execution, or access to data outside the user's normal operational scope.
• Availability Monitoring: Monitor for unexpected process restarts, kernel-level service crashes, or system availability degradation on NetWeaver AS ABAP hosts that could indicate memory corruption resulting from exploitation attempts.
• Configuration Change Alerting: Alert on any unauthorized changes to ICF node configurations in transaction SICF, which could indicate an attacker attempting to re-enable nodes disabled as part of the temporary workaround.
Indicators of Compromise
No indicators of compromise were identified for this vulnerability at the time of publication. CVE-2026-44747 was disclosed as part of SAP's routine Security Patch Day with no associated exploitation activity or campaign observed.
Recommendations
• Apply SAP Security Note 3747367 to all affected NetWeaver AS ABAP kernel versions as the primary remediation; prioritize this as urgent given the CVSS 9.9 score.
• Where immediate patching is not feasible, apply the temporary workaround of disabling affected ICF nodes via transaction SICF, understanding this will disrupt normal functionality for those nodes.
• Inventory all SAP NetWeaver AS ABAP kernel versions across the environment to confirm exposure to the affected version ranges.
• Review and restrict low-privileged user account access where not operationally necessary, given the low-privilege exploitation requirement.
• Increase monitoring of NetWeaver AS ABAP systems for the indicators described in Detection Methods until patches are confirmed deployed.
• Validate patch deployment through the SAP Support Portal and re-verify kernel versions after patching.
Conclusion
CVE-2026-44747 is the highest-severity vulnerability in SAP's July 2026 patch cycle and demands priority attention from any organization running SAP NetWeaver AS ABAP. Its position in the core ABAP kernel, combined with a 9.9 CVSS score, network-accessible exploitation requiring only low-privilege credentials, and a scope-change rating, means a single compromised low-privilege account is a sufficient foothold for broad ERP compromise. The availability of a temporary SICF workaround provides a stopgap for environments where immediate kernel patching is operationally constrained, but patching via SAP Note 3747367 is the only complete remediation. We urge organizations to treat this as a priority maintenance action, validate their kernel versions, and maintain heightened monitoring of NetWeaver AS ABAP environments until patches are fully deployed.