SAP Patches CVSS 9.9 Net Weaver ABAP Flaw That Could Expose or Modify Data
Summary: SAP's July 2026 security updates address CVE-2026-44747, a CVSS 9.9 out-of-bounds write flaw in SAP NetWeaver Application Server ABAP that lets an authenticated attacker exploit memory management errors to cause corruption leading to unauthorized data access, modification, or system unavailability. SAP also fixed CVE-2026-44761, where sample OAuth 2.0 configuration scripts from the SAP Help Portal left hard-coded, well-known credentials that an unauthenticated attacker could use to obtain a valid access token and read or modify data.
What's compelling: The OAuth flaw only bites customers who ran SAP's own sample script and kept the default client in production with its hard-coded secret - so the exposure sits in configurations inherited from vendor documentation, not in code anyone wrote. There is no evidence of exploitation in the wild yet, but a CVSS 9.9 memory corruption flaw in NetWeaver ABAP is a patch you schedule now rather than later.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-44747CVE-2026-44761
- Related
- ⚡ Weekly Recap: Word Press RCE, Sonic Wall 0-Days, AI Service Attacks, Share Point 0-Day and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026