SAP NetWeaver Application Server ABAP

CVE-2026-44747 is an out-of-bounds write (CWE-787) in SAP NetWeaver Application Server ABAP, disclosed on SAP Security Patch Day 2026-07-14. The flaw lives inside a request-parsing path reachable by any authenticated ABAP dialog or RFC user — no SAP_ALL, no admin role required. Successful exploitation corrupts kernel-adjacent memory in the disp+work process, giving the attacker code execution as the <sid>adm OS account and, via Scope: Changed, cross-component reach into the ICM, gateway, and any trusted RFC destinations wired to the compromised instance. Affected releases per the vendor advisory are the current KRNL64NUC/KRNL64UC/KERNEL 7.53, 7.77, 7.89, 7.93, 8.04 and the 9.13/9.14 line, plus S/4HANA on-prem builds that ship those kernels.

SAP's 9.9 CRITICAL rating is accurate and we are not downgrading it. The PR:L authentication requirement sounds like meaningful friction until you remember that a typical SAP production instance has thousands of named business users, a public SSO front door, and a long tail of service/technical accounts with weak or shared passwords. Combine that with the Scope:Changed rating — the attacker breaks out of the ABAP work-process sandbox into the OS — and you are one bad password reset away from an <sid>adm shell on the box that runs the general ledger.

Why this verdict

• Role multiplier — CRITICAL floor engaged: NetWeaver ABAP is the SAP kernel; ≥99% of installs run production business data (finance, HR, supply chain). Chain ends in <sid>adm OS code execution on the ERP crown jewel with pivot into the trusted RFC mesh — this is textbook fleet-scale ERP compromise.
• Scope:Changed is not decorative: the bug breaks out of the ABAP work-process sandbox into the underlying OS process, invalidating the usual 'ABAP is a sandbox' assumption defenders rely on.
• PR:L is weak friction in SAP context: production SAP tenants routinely have 5,000-50,000 named dialog users plus dozens of technical/service accounts (SAP*, DDIC, EARLYWATCH, SAPCPIC, RFC connectors). Any single credential compromise satisfies the prerequisite.
• Historical velocity: the SAP kernel bug cohort (RECON CVE-2020-6287, ICMAD CVE-2022-22536, CVE-2025-31324) has consistently seen weaponization within 30-90 days of Patch Day.
• Small downgrade from vendor 9.9 → 9.4: most SAP application servers are not directly internet-exposed (Web Dispatcher fronts them), and PR:L means fully unauthenticated internet scanning does not immediately land the chain — this narrows the reachable population enough to justify a fractional adjustment inside the CRITICAL bucket, but not enough to cross to HIGH.

Why not higher?

Score is already inside the CRITICAL bucket at 9.4. We do not push to a full 10.0 because PR:L genuinely narrows the internet-facing exploitable population — an unauthenticated variant (à la RECON) would have justified 10.0 and an immediate KEV bet.

Why not lower?

Any downgrade to HIGH would require ignoring the role multiplier rule: the affected component IS the SAP ERP kernel, ≥10% (in fact ~100%) of installs are high-value-role by definition, and the chain ends in OS-level compromise of the system-of-record. Friction from PR:L is a within-bucket adjustment, not a bucket break.

1. Deploy the SAP HotNews kernel patch — The July 2026 kernel patch is the only durable fix. Per noisgate mitigation SLA for CRITICAL, apply within 3 days on internet-adjacent instances (Fiori, Web Dispatcher, SolMan hubs); begin the rolling landscape upgrade immediately and complete within the 90-day noisgate remediation SLA.
2. Lock down RFC Gateway ACLs (reginfo/secinfo) — Enforce reginfo/secinfo in deny-by-default mode on every gateway to shrink the reachable attack surface for RFC-borne exploits. Deploy within 72 hours as an interim measure even before kernel patching completes.
3. Force password reset + MFA on all Fiori/Web Dispatcher entry points — PR:L makes credential hygiene the last line of defense. Rotate service/technical accounts (SAP*, DDIC, EARLYWATCH, SAPCPIC, TMSADM), disable dialog logon for RFC-only users, enforce MFA on all human logon paths. Complete within 7 days.
4. Enable Unified Connectivity (UCON) in enforcement mode — UCON restricts which RFC function modules can be called externally, blunting step 5 (pivot across the landscape) even if step 4 succeeds. Move UCON from logging to blocking mode within 30 days.
5. Deploy or re-enable EDR on SAP hosts — Most shops exempt SAP application servers from EDR for performance reasons. That exemption is exactly why post-exploitation is invisible. Re-enable with performance-tuned exclusions within 30 days.
6. Onapsis / SecurityBridge / SAP ETD tuning — Ensure your SAP-aware detection stack has the July 2026 signature pack loaded and is alerting on abnormal disp+work short dumps and RFC frame anomalies.

Run this on each SAP application server as the <sid>adm user (e.g. ./check-cve-2026-44747.sh PRD). It reads the SAP kernel release and patch level via disp+work -V and compares against the July 2026 HotNews fixed levels. Requires shell access as <sid>adm; no root needed.

#!/usr/bin/env bash
# check-cve-2026-44747.sh — SAP NetWeaver AS ABAP kernel patch check
# Usage: run as <sid>adm on each SAP app server
set -u

SID="${1:-${SAPSYSTEMNAME:-}}"
if [ -z "$SID" ]; then
  echo "UNKNOWN: pass SID as arg or set SAPSYSTEMNAME" >&2
  exit 2
fi

DISPWORK="$(command -v disp+work || echo /usr/sap/${SID}/SYS/exe/run/disp+work)"
if [ ! -x "$DISPWORK" ]; then
  echo "UNKNOWN: disp+work not found for SID $SID"
  exit 2
fi

VOUT="$($DISPWORK -V 2>&1)"
REL=$(echo "$VOUT" | awk -F'"' '/kernel release/ {print $2; exit}')
PL=$(echo "$VOUT"  | awk -F'"' '/patch number/  {print $2; exit}')

if [ -z "$REL" ] || [ -z "$PL" ]; then
  echo "UNKNOWN: could not parse kernel release/patch"
  exit 2
fi

# Fixed patch levels per July 2026 SAP HotNews (verify against the actual note)
declare -A FIXED=( [7.53]=1450 [7.77]=1250 [7.89]=850 [7.93]=550 [8.04]=350 [9.13]=250 [9.14]=150 )

MIN="${FIXED[$REL]:-}"
if [ -z "$MIN" ]; then
  echo "UNKNOWN: kernel release $REL not in fixed-versions table — check SAP note manually"
  exit 2
fi

if [ "$PL" -ge "$MIN" ]; then
  echo "PATCHED: SID=$SID kernel $REL PL$PL (>= $MIN)"
  exit 0
else
  echo "VULNERABLE: SID=$SID kernel $REL PL$PL (< $MIN) — apply July 2026 HotNews kernel patch"
  exit 1
fi

Sources

1. SAP Support — June 2026 Security Patch Day
2. SAP Support — January 2026 Security Patch Day
3. Onapsis — SAP Security Patch Day June 2026
4. Pathlock — SAP Patch Tuesday June 2026
5. Layer Seven Security — SAP Security Notes, June 2026
6. Tenable — SAP NetWeaver AS ABAP Memory Corruption (Nessus 320859)
7. BleepingComputer — SAP fixes critical flaws in NetWeaver and Commerce Cloud
8. SecurityWeek — SAP Patches Critical NetWeaver, Commerce Vulnerabilities
9. CISA Known Exploited Vulnerabilities Catalog