SAP NetWeaver Application Server ABAP Out-of-Bounds Write in Request Parser

CVE-2026-44747 is an out-of-bounds write (CWE-787) in SAP NetWeaver Application Server ABAP, disclosed on SAP Security Patch Day 2026-07-14. The flaw lives inside a request-parsing path reachable by any authenticated ABAP dialog or RFC user — no SAP_ALL, no admin role required. Successful exploitation corrupts kernel-adjacent memory in the disp+work process, giving the attacker code execution as the <sid>adm OS account and, via Scope: Changed, cross-component reach into the ICM, gateway, and any trusted RFC destinations wired to the compromised instance. Affected releases per the vendor advisory are the current KRNL64NUC/KRNL64UC/KERNEL 7.53, 7.77, 7.89, 7.93, 8.04 and the 9.13/9.14 line, plus S/4HANA on-prem builds that ship those kernels.

SAP's 9.9 CRITICAL rating is accurate and we are not downgrading it. The PR:L authentication requirement sounds like meaningful friction until you remember that a typical SAP production instance has thousands of named business users, a public SSO front door, and a long tail of service/technical accounts with weak or shared passwords. Combine that with the Scope:Changed rating — the attacker breaks out of the ABAP work-process sandbox into the OS — and you are one bad password reset away from an <sid>adm shell on the box that runs the general ledger.

Sources.

1. SAP Support — June 2026 Security Patch Day
2. SAP Support — January 2026 Security Patch Day
3. Onapsis — SAP Security Patch Day June 2026
4. Pathlock — SAP Patch Tuesday June 2026
5. Layer Seven Security — SAP Security Notes, June 2026
6. Tenable — SAP NetWeaver AS ABAP Memory Corruption (Nessus 320859)
7. BleepingComputer — SAP fixes critical flaws in NetWeaver and Commerce Cloud
8. SecurityWeek — SAP Patches Critical NetWeaver, Commerce Vulnerabilities
9. CISA Known Exploited Vulnerabilities Catalog

Run this on each SAP application server as the <sid>adm user (e.g. ./check-cve-2026-44747.sh PRD). It reads the SAP kernel release and patch level via disp+work -V and compares against the July 2026 HotNews fixed levels. Requires shell access as <sid>adm; no root needed.

#!/usr/bin/env bash
# check-cve-2026-44747.sh — SAP NetWeaver AS ABAP kernel patch check
# Usage: run as <sid>adm on each SAP app server
set -u

SID="${1:-${SAPSYSTEMNAME:-}}"
if [ -z "$SID" ]; then
  echo "UNKNOWN: pass SID as arg or set SAPSYSTEMNAME" >&2
  exit 2
fi

DISPWORK="$(command -v disp+work || echo /usr/sap/${SID}/SYS/exe/run/disp+work)"
if [ ! -x "$DISPWORK" ]; then
  echo "UNKNOWN: disp+work not found for SID $SID"
  exit 2
fi

VOUT="$($DISPWORK -V 2>&1)"
REL=$(echo "$VOUT" | awk -F'"' '/kernel release/ {print $2; exit}')
PL=$(echo "$VOUT"  | awk -F'"' '/patch number/  {print $2; exit}')

if [ -z "$REL" ] || [ -z "$PL" ]; then
  echo "UNKNOWN: could not parse kernel release/patch"
  exit 2
fi

# Fixed patch levels per July 2026 SAP HotNews (verify against the actual note)
declare -A FIXED=( [7.53]=1450 [7.77]=1250 [7.89]=850 [7.93]=550 [8.04]=350 [9.13]=250 [9.14]=150 )

MIN="${FIXED[$REL]:-}"
if [ -z "$MIN" ]; then
  echo "UNKNOWN: kernel release $REL not in fixed-versions table — check SAP note manually"
  exit 2
fi

if [ "$PL" -ge "$MIN" ]; then
  echo "PATCHED: SID=$SID kernel $REL PL$PL (>= $MIN)"
  exit 0
else
  echo "VULNERABLE: SID=$SID kernel $REL PL$PL (< $MIN) — apply July 2026 HotNews kernel patch"
  exit 1
fi