On July 14, SAP's monthly Patch Day shipped 16 new security notes, one GitHub security advisory, and three updates to previously released notes. The headline item is CVE-2026-44747, a memory corruption vulnerability in NetWeaver Application Server ABAP carrying a CVSS score of 9.9 — one-tenth of a point below the maximum possible severity rating. It's classified as CWE-787, an out-of-bounds write, and it affects a wide swath of ABAP kernel releases: KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22 through 7.93, and versions 9.16 through 9.20. If your organization runs SAP NetWeaver in any capacity, this is this month's must-patch item — and the detail that makes it "only" require authentication is exactly the detail worth being skeptical about.
What the bug actually does
An authenticated attacker with low privileges can exploit logical errors in memory management to trigger memory corruption in NetWeaver AS ABAP. Depending on how successfully the corruption is leveraged, that can mean altering program execution, accessing sensitive information, crashing services, or in some conditions executing malicious code. The vulnerability is exploitable remotely — the attacker doesn't need physical or network-adjacent access, just valid low-privilege credentials on the target system. SAP's fix is documented in Security Note 3747367, and the company has also published a temporary mitigation: administrators can disable all ICF nodes with a specific property via transaction SICF while working through the permanent patch.
Why "requires authentication" is the wrong takeaway
It's tempting to read "authenticated, low-privilege attacker" and mentally downgrade this from "unauthenticated remote code execution" to "manageable, since an attacker needs an account first." That reasoning breaks down fast against how SAP environments actually get compromised in practice. Low-privilege SAP credentials are routinely obtained through phishing, credential stuffing against internet-facing SAP portals, reused passwords from unrelated breaches, or — increasingly common this year — through third-party and vendor access that was never properly scoped down after a project ended. None of those attack paths require sophistication, and all of them are common enough that "requires low-privilege authentication" should be read as "requires a foothold that a meaningful share of real-world attackers already have or can obtain cheaply," not as "requires nation-state-level access."
This is the same pattern that's played out repeatedly in 2026 across other enterprise software categories: the vulnerabilities that actually get exploited in the wild are frequently the ones requiring some baseline access, chained together with a separate, unrelated credential compromise, rather than the rarer fully-unauthenticated bugs. Treating an authenticated-attacker CVE as lower priority because of that qualifier is a common and costly misjudgment.
Why NetWeaver specifically raises the stakes
NetWeaver AS ABAP underpins a huge share of SAP's enterprise resource planning footprint — financials, supply chain, HR, and core business logic for organizations that have run SAP for decades and have every reason not to touch it more than absolutely necessary. That operational conservatism is exactly what makes NetWeaver systems attractive targets: they tend to run longer between maintenance windows, have more legacy integrations that make patching riskier to schedule, and often carry more unaudited third-party or vendor access accumulated over years than newer, more actively managed systems. A CVSS 9.9 in exactly this kind of system is a high-value target for any attacker who can get a foothold, because a compromised NetWeaver instance frequently sits at the center of financial and operational data an organization can least afford to have manipulated or exfiltrated.
What to actually do this week
Identify every NetWeaver AS ABAP instance in your environment first — don't assume you already have a complete list. SAP environments frequently include shadow instances stood up for testing, migration projects, or specific business units that never made it into the central asset inventory. Cross-reference your CMDB against actual running SAP kernel versions before assuming you know your exposure.
Apply Security Note 3747367 as a priority patch, not a routine maintenance-window item. Given the CVSS score and the breadth of affected kernel versions, this warrants an out-of-cycle change request if your normal SAP patch cadence would otherwise push it weeks out.
Apply the ICF node mitigation via SICF immediately on any system that can't be patched same-week. SAP's documented workaround — disabling ICF nodes with the specified property — buys time without requiring a full patch cycle, and there's no good reason not to apply it as an interim control while patch testing completes.
Audit low-privilege account provisioning across your SAP landscape. Given that this vulnerability requires only authenticated, low-privilege access, use this as the forcing function to review which accounts currently hold low-privilege SAP access, whether that access is still justified, and whether any third-party or vendor accounts from completed projects are still active and should have been deprovisioned already.
Review authentication logging and anomaly detection specifically for NetWeaver systems. If your SIEM or logging setup doesn't currently have specific detection rules for anomalous authenticated activity against ABAP systems — unusual login times, unfamiliar source IPs for known accounts, privilege-escalation attempts — this is a good prompt to add them, since exploitation of this class of bug would likely show up first as unusual authenticated behavior rather than an obvious external intrusion signature.
Don't stop at the headline CVE. SAP's July Patch Day included 16 new security notes beyond CVE-2026-44747, plus updates to previously released notes covering Approuter and Commerce Cloud. Pull the complete list and work through every note that applies to your SAP footprint, not just the one that made headlines.
The pattern this fits
CVE-2026-44747 is part of a broader trend this year of critical vulnerabilities in the enterprise systems organizations are least equipped to patch quickly — legacy ERP platforms, long-lived network appliances, and infrastructure software that's been stable and unmaintained for years precisely because it works. The technical fix here is straightforward once you know where to apply it. The harder problem, and the one worth solving regardless of this specific CVE, is knowing your actual SAP footprint well enough to apply a fix like this quickly the next time a Patch Day drops something this severe — because at a 9.9 CVSS score, "next time we do a scheduled review" isn't an adequate response timeline.