SAP dropped its July 2026 security updates this week, and out of 16 total fixes, three earned the company’s “critical” label, two of which sit squarely inside its cloud infrastructure.
Start with CVE-2026-44747, a bug living inside NetWeaver Application Server ABAP, the platform a huge chunk of SAP’s enterprise customers use to run core business software, both on-premises and increasingly through SAP’s cloud deployments. An attacker who’s already authenticated can exploit flawed memory management logic to corrupt data, and from there, things get ugly fast: unauthorized access, tampered records, or the whole system grinding to a halt.
Then there’s CVE-2026-27690, sitting in Approuter, the Node.js middleware that routes traffic for apps built on SAP’s Business Technology Platform, the company’s cloud environment for building and running enterprise applications. This one’s arguably worse in a practical sense, since it doesn’t need authentication at all. Send the right kind of crafted HTTP request, and an attacker can intercept another cloud user’s response or just knock the service offline, a trick known as HTTP request smuggling, which is particularly concerning on a multi-tenant cloud platform where many customers share infrastructure.
The third critical bug, CVE-2026-44761, traces back to something almost embarrassingly simple: default credentials still active inside SAP Commerce Cloud, the company’s cloud-based e-commerce platform. Anyone who finds them can mint valid access tokens and start reading or changing data through certain cloud APIs, no elaborate exploit chain required.
Beyond those three, the July advisory lists six high-severity issues and seven medium ones, covering the usual grab bag of enterprise software headaches: SQL injection, cross-site scripting, path traversal, remote code execution. SAP says it hasn’t seen evidence that anyone’s actively exploiting this batch yet, which is good news, though not exactly a guarantee for cloud customers running exposed instances.
Here’s the part worth sitting with: CISA has added 14 separate SAP vulnerabilities to its known-exploited list since late 2021, and two of those got picked up by ransomware crews targeting cloud and on-premises deployments alike. SAP addressed 15 flaws just last month, and attackers recently managed to slip malicious code into several of the company’s official npm packages, going after cloud credentials directly on developers’ machines.
Given that SAP’s cloud and enterprise software runs inside 99 of the world’s 100 largest companies, the patch window here is short for a reason. Attackers don’t usually wait long to reverse-engineer what a vendor just told them was worth fixing.
