SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data

SAP released July 2026 security updates addressing multiple critical vulnerabilities — most notably CVE-2026-44747 (CVSS 9.9) in SAP NetWeaver AS ABAP that can cause out-of-bounds memory corruption, CVE-2026-27690 (CVSS 9.1) HTTP request/response smuggling in Approuter, and CVE-2026-44761 (CVSS 9.1) involving default/sample OAuth 2.0 credentials in Commerce Cloud. SAP and Onapsis recommend applying patches, and customers should audit and remove or reconfigure any sample OAuth clients retained in production; no evidence of active exploitation was reported.