SAP safety alert July 2026: critical failures in ABAP, Aprouter and OAuth that can expose data and affect operations

SAP published its July 2026 security patches correcting several critical failures affecting widely used business environments, including a vulnerability of Unlimited writing in SAP NetWeaver Application Server ABAP (CVE-2026-44747) which receives an almost maximum CVSS score and which, in scenarios where an attacker is authenticated, can cause memory corruption with impact on confidentiality, integrity and availability. Although there is no public evidence of mass exploitation at present, the technical gravity and potential scope - ERP systems, financial processes and sensitive data - make the response a priority. More general information on SAP security notices is available on the official SAP page: SAP Product Security.

In addition to the ABAP failure, the newsletters include a HTTP request / response smuggling in SAP Approuter deployments outside Cloud Foundry (CVE-2026-27690) which allows a non-authenticated attacker to deconchronize requests and responses to exfiltrate information or cause service denials, and a OAuth 2.0 default configuration in SAP Commerce Cloud (CVE-2026-44761) where example customers with public credentials can remain in production and be reused by attackers to get valid tokens. Notices and public information on vulnerabilities can be compared with databases such as NVD: NVD - National Vulnerability Database.

From the operational point of view, the first rule is to prioritize the application of patches: install the versions of the ABAP kernel and the official patches for Aprouter and Commerce Cloud in test environments as soon as possible, followed by productive environments within a controlled maintenance window. SAP and security signatures like Onapsis have reported that as a temporary measure certain ICF nodes can be disabled by the SICF transaction, but that solution involves loss of SAP GUI functionality for HTML and therefore is not viable for many organizations; it must be reserved as an emergency measure and assessed together with business areas for the functional impact.

In the case of the failure linked to OAuth in Commerce Cloud, immediate and non-negotiable remediation is to audit the presence of OAuth customers created from example scripts. If a client with public credentials is detected, the customer must be removed or its secret must be rotated immediately by a strong and unique. Please also check that internal documentation and deployment processes do not again import production example configurations and implement policies that block hard- coded secrets in deployment repositories or scripts.

To mitigate risks associated with HTTP smuggling and service denial vectors, apply the official patches, but also consider complementary measures: enable controls on the reverse proxy or WAF that detect and block desynchronization patterns, adjust timeouts and header limits, and review safety rules in the swimmer. In environments where it is not possible to park immediately, reduce exposure of sensitive components to public networks and limit IP or VPN access to administration layers and critical routes.

Do not underestimate the need for visibility and detection: review access and server logs for unusual patterns, set up SIEM alerts for attempts to use known credentials, and monitor tokens OAuth and API calls with high privileges. Integrate the verification of these CVE in your vulnerability management cycle and in the configuration of automated scans to avoid regressions in future deployments.

Finally, consider the regulatory and business impact: exploitation of these vulnerabilities could involve personal data leakage or transaction manipulation, which requires the activation of incident response plans, notifications to stakeholders and, where appropriate, regulatory authorities. Maintain communication with suppliers and partners, document the actions taken and schedule a post-patch review to validate the stability and coverage of controls. For analysis and specialized advice on SAP it is recommended to consult security providers with experience in ERP such as Onapsis: Onapsis.